CVE-2016-10459

Vulnerability

CVE-2016-10459 is a memory exhaustion vulnerability in the Qualcomm components of Android, affecting the Snapdragon Mobile and Snapdragon Wear platforms. The issue occurs during a call and leads to memory exhaustion. Affected chipsets include MDM9206, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 800, SD 810, and SD 820. The vulnerability is fixed in Android security patch level 2018-04-05 or earlier [1].

Exploitation

An attacker must be able to initiate or participate in a call on an affected device. The exact prerequisites are not fully detailed in the available references, but the vulnerability can be triggered during normal call handling, potentially by network-based or local manipulation of call parameters to cause excessive memory allocation [1].

Impact

Successful exploitation leads to memory exhaustion, which can cause the device to become unresponsive or crash, resulting in a denial of service (DoS). No code execution or privilege escalation is described; the primary impact is on availability [1].

Mitigation

The vulnerability is addressed in the Android security patch level 2018-04-05 or earlier, as indicated in the April 2018 Android Security Bulletin. Users should ensure their devices have received the relevant OTA update or flashed the latest firmware from their vendor. No workaround is detailed [1].