CVE-2015-6647

Vulnerability

The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and Android 6.0 before the 2016-01-01 security patch level allows a crafted application with QSEECOM access to trigger a privilege escalation [1]. The vulnerability resides in the Qualcomm Secure Execution Environment (QSEE) TrustZone component responsible for Widevine DRM operations.

Exploitation

An attacker must first install a malicious application on the device that can interact with the QSEECOM driver. By leveraging QSEECOM access, the application can send crafted commands to the Widevine TrustZone application, exploiting the vulnerability to gain elevated privileges [1]. No additional user interaction beyond installation is required.

Impact

Successful exploitation results in privilege escalation within the TrustZone environment, potentially allowing the attacker to execute arbitrary code with higher privileges than the application normally possesses [1]. This could lead to compromise of sensitive data protected by the TrustZone, such as DRM keys or other secure assets.

Mitigation

Google released fixes in the January 2016 Android Security Bulletin. Devices running Android 5.1.1 build LMY49F or later, or Android 6.0 with a security patch level of January 1, 2016 or later, are patched [1]. Partners were notified on December 7, 2015. Users should apply the OTA update or flash the updated firmware. No workarounds are available for unpatched devices.