CVE-2015-6640

Vulnerability

The prctl_set_vma_anon_name function in kernel/sys.c contains a typo that allows it to set the anonymous VMA name across two adjacent VMAs simultaneously, instead of a single VMA. This can corrupt the VMA list. Affected versions include Android before 5.1.1 LMY49F and Android 6.0 before the January 1, 2016 security patch level [1][2].

Exploitation

An attacker with the ability to execute a crafted application on the device can trigger the bug by invoking the prctl system call with specific arguments. No additional permissions beyond those required to call the syscall are needed. The corrupted VMA list can lead to memory corruption or system instability [1][2].

Impact

Successful exploitation can result in local privilege escalation to the kernel level or cause a denial of service via system crash. The vulnerability is rated High severity with a CVSS v3 score of 7.8 [1].

Mitigation

Google addressed this issue in Android 5.1.1 LMY49F and later, and in Android 6.0 with the January 1, 2016 security patch level or later. The fix is also available in the Android Open Source Project (AOSP) as commit 69bfe2d957d903521d32324190c2754cb073be15 [2]. Users should apply the available OTA updates or flash the latest firmware images [1].