CVE-2014-10043

Vulnerability

A buffer overread vulnerability exists in the Qualcomm secure monitor (TZ App) on multiple Snapdragon platforms, including MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SD 800. While processing PlayReady rights string information from a command buffer sent from the non-secure side, a large length value causes the secure monitor to read beyond the intended buffer boundary. This issue is present in Android security patch levels before the April 2018 patch on affected Qualcomm chipsets [1].

Exploitation

An attacker requires the ability to send crafted command buffers to the secure monitor from the non-secure side. By embedding an overly long rights string length in the PlayReady command, the attacker triggers a controlled out-of-bounds read. No user interaction or elevated privileges are needed beyond the ability to invoke the vulnerable service from the normal Android application layer [1].

Impact

Successful exploitation results in an information disclosure, exposing TrustZone (TZ) App memory to the non-secure side. This can leak sensitive data stored in the secure world, such as cryptographic keys or other protected assets, to an untrusted application. The attacker gains unauthorized read access to secure memory regions [1].

Mitigation

The issue is fixed in Android security patch level 2018-04-05 or later. Users should apply the April 2018 Android security update from their device vendor. No workarounds are available if the patch is not yet applied. There is no indication that this CVE is listed on CISA's Known Exploited Vulnerabilities catalog [1].