CVE-2017-9725: High severity Google Android vulnerability
A flaw was found in the Linux kernels implementation of DMA memory allocation.
When allocating a DMA buffer, a section of memory is allocated and then set to zeros. The size parameter of allocation was truncated due to an incorrect casting when the allocation function is called. During clearing the allocation used an untruncated value as the size to clear and would "zero" a larger section of kernel memory than was allocated, possibly corrupting memory and allowing for privilege escalation.
At this time Red Hat Product Security believes that there is no direct control of the size parameter used in this function in Red Hat kernels.
Patch:
https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?h=aosp/android-4.4&id=1f8f9b566e8446c13b954220c226c58d22076f88
Other sources
In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.3
Event History
Frequently Asked Questions
What level of access is indicated for exploitation?
The CVSS vector indicates local access, no required privileges, and user interaction. Successful exploitation could affect confidentiality, integrity, and availability.
Which deployments are specifically identified as affected?
The issue is identified in Qualcomm products using Android releases from CAF with the Linux kernel, as well as Google Android and Red Hat kernel software entries. No affected version ranges are provided.
Is there evidence that an attacker can directly control the vulnerable allocation size in Red Hat kernels?
Red Hat Product Security stated that it believed there was no direct control of the size parameter used by this function in Red Hat kernels at the time of the assessment. This limits the described direct exploitation path, but does not establish that the kernels are unaffected.