CVE-2015-9185

Vulnerability

In Android before the 2018-04-05 security patch level on Qualcomm Snapdragon SoCs (MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850), multiple Secure DEMUX functions such as SDMX_open_session, SDMX_close_session, and SDMX_set_session_cfg fail to validate that the response buffer length (rsplen) passed from HLOS is large enough to hold the error code when parameter validation fails. If the buffer is at the end of a non-secure page followed by secured memory, this flaw can lead to secure memory corruption [1].

Exploitation

An attacker must trigger a parameter validation failure in one of the affected Secure DEMUX functions, potentially via a malicious application or crafted system call. The exploit requires the response buffer to be positioned at the end of a non-secure memory page immediately adjacent to secured memory. No additional authentication or user interaction is specified beyond local access [1].

Impact

Successful exploitation results in corruption of secure memory, which may enable an attacker to write arbitrary data into secured memory regions. This could lead to privilege escalation or disclosure of sensitive information protected by the secure execution environment [1].

Mitigation

Google released a fix in the Android security patch level 2018-04-05 or later. Users are advised to apply the latest Android security updates from their device manufacturer. No workaround is available without updating [1].