CVE-2016-3823

Vulnerability

The secure-session feature in the mm-video-v4l2 venc component of mediaserver in Android mishandles heap pointers. In secure sessions, heap pointers do not point to user virtual addresses but are accessed without proper checks. This affects Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 [1].

Exploitation

An attacker with a crafted application can trigger the vulnerability by causing the component to access heap pointers during a secure session. No additional privileges are required beyond the ability to run the crafted app. The mishandling leads to memory corruption.

Impact

Successful exploitation results in elevation of privilege within the mediaserver process. The attacker can achieve arbitrary code execution in the context of mediaserver, potentially leading to disclosure of sensitive data or further system compromise.

Mitigation

Google fixed the issue in the August 2016 Android security bulletin [1]. The commit [2] sets heap pointers to NULL and adds checks to prevent access in secure sessions. Users should update to Android 4.4.4, 5.0.2, 5.1.1, or 6.0 with security patch level 2016-08-01 or later.