CVE-2015-9188

Vulnerability

In the Secure DEMUX command handler on Qualcomm Snapdragon chipsets (MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850), when parameter validation fails, an error code is written into a response buffer without checking the buffer length passed from the HLOS (High Level OS). This missing length check can result in memory corruption. The vulnerability affects Android versions before the 2018-04-05 security patch level [1].

Exploitation

An attacker must be able to send crafted input to the Secure DEMUX command handler, likely requiring local access or the ability to execute code at a sufficient privilege level (e.g., from a system process or a malicious application). By providing a response buffer length smaller than the error code being written, the attacker can trigger an out-of-bounds write, corrupting adjacent memory.

Impact

Successful exploitation leads to memory corruption, which could allow an attacker to execute arbitrary code within the context of the secure environment or cause a denial of service. The exact impact depends on the memory layout and the attacker's ability to control the corrupted data.

Mitigation

Google released a fix as part of the Android Security Bulletin for April 2018 (security patch level 2018-04-05 or later). Users should update their devices to the latest available security patch. No workaround is documented [1].