CVE-2016-10484

Vulnerability

A buffer overflow vulnerability exists in the RPMB (Replay Protected Memory Block) listener implementation on Qualcomm Snapdragon platforms. When a listener is registered with a very small buffer size, the calculation of the maximum transfer size for read and write operations can underflow, leading to a heap-based buffer overflow. Affected chipsets include IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20. The issue is patched in the Android security patch level of 2018-04-05 or earlier [1].

Exploitation

An attacker must have the ability to register an RPMB listener with a specifically chosen small buffer size. This likely requires local access or the ability to invoke a driver interface from a privileged context. No user interaction or network access is needed beyond local system access. The underflow in the size calculation occurs during subsequent read or write operations, causing the overflow.

Impact

Successful exploitation results in a buffer overflow, which can corrupt adjacent memory. This may lead to arbitrary code execution with elevated privileges or the disclosure of sensitive data stored in RPMB (e.g., device-specific keys). The impact is confined to the local system; remote exploitation is not feasible.

Mitigation

Google released the fix in the Android Security Bulletin dated April 2018, and Qualcomm provided the patch to OEMs. Devices with a security patch level of 2018-04-05 or later are protected. Users should ensure their devices receive OTA updates. No workaround is available for unpatched devices [1].