CVE-2016-3847

Vulnerability

The vulnerability resides in the NVIDIA media driver on Nexus 9 devices running Android prior to the August 5, 2016 security update. A crafted application can exploit this driver to gain elevated privileges. The affected versions are Android builds before the 2016-08-05 patch level. [1]

Exploitation

An attacker must install a malicious application on the device. No additional authentication or network access is required beyond the ability to run the crafted app. The application triggers the vulnerability in the media driver to escalate privileges. [1]

Impact

Successful exploitation allows the attacker to gain elevated privileges on the device, potentially leading to full control over the affected system. This corresponds to a high severity elevation of privilege vulnerability. [1]

Mitigation

The vulnerability is fixed in the Android security update released on August 5, 2016. Users should apply the update to Nexus 9 devices. No workarounds are provided. [1]