CVE-2015-9109

Vulnerability

The vulnerability resides in the qsee_fuse_write function within the Qualcomm secure execution environment (QSEE) on affected Snapdragon platforms. The function fails to validate the address argument, allowing an untrusted pointer dereference. Affected chipsets include MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, on Android devices with security patch levels before April 5, 2018 [1].

Exploitation

An attacker with local access and the ability to invoke the qsee_fuse_write function (likely requiring root or system privileges) can supply a crafted address argument. The lack of validation causes the kernel to dereference an arbitrary pointer, potentially leading to memory corruption or code execution. No user interaction is needed beyond the initial compromise of sufficient privileges.

Impact

Successful exploitation could allow an attacker to escalate privileges within the Android kernel or QSEE, potentially gaining full control over the device's secure environment. This could lead to disclosure of sensitive data, modification of system settings, or persistent compromise.

Mitigation

Google's April 2018 Android Security Bulletin includes a fix for this vulnerability. Devices that have received the 2018-04-05 security patch level or later are protected. Users should ensure their devices are updated to the latest security patch. No workaround is available for unpatched devices [1].