CVE-2016-5859

Vulnerability

An integer overflow vulnerability exists in a sound driver function used across all Qualcomm products that run Android for MSM, Firefox OS for MSM, or QRD Android. When the function is called with a very large length value, the integer wrap can cause a subsequent heap buffer overflow. Affected versions include all Android for MSM, Firefox OS for MSM, and QRD Android builds prior to the May 2017 security patch level.

Exploitation

An attacker needs local access to the affected device and the ability to execute a program that calls the vulnerable sound driver function with a crafted large length argument. No user interaction beyond running the malicious program is required, and the attack does not depend on a race condition or network position.

Impact

Successful exploitation allows an attacker to gain elevated privileges within the kernel, leading to a complete compromise of confidentiality, integrity, and availability (CIA impact). The attack is rated High severity with a CVSS v3 base score of 7.0.

Mitigation

Google released a fix as part of the May 1, 2017 Android Security Bulletin [1]. Users should apply the Android security update provided by their device vendor. No workaround other than applying the patch is documented.