CVE-2017-0471

Vulnerability

CVE-2017-0471 is a remote code execution (RCE) vulnerability in Android's Mediaserver component, resulting from memory corruption during media file and data processing. An attacker can exploit this by crafting a malicious file that, when processed by Mediaserver, triggers the corruption. The flaw exists in Android versions 6.0, 6.0.1, 7.0, and 7.1.1 as identified in the March 2017 Android Security Bulletin [1][2].

Exploitation

The attacker requires no special privileges beyond the ability to deliver a specially crafted media file to the target device (e.g., via email, web download, or MMS). No user interaction is needed beyond normal media processing by Mediaserver, which may occur automatically. The exploit achieves memory corruption, leading to code execution within the Mediaserver process [1][2].

Impact

Successful exploitation permits arbitrary code execution in the context of the Mediaserver process, enabling an attacker to potentially read/write sensitive data, install malicious code, or gain further access to the device. The severity is rated as Critical due to the potential for remote code execution without user interaction [1][2].

Mitigation

Google released a security patch for this issue in the March 2017 Android Security Bulletin. The fix was included in the 2017-03-01 security patch level. Users should ensure their devices have received this update. No workaround is available beyond applying the official patch [1][2].