CVE-2017-0482

Vulnerability

A denial of service vulnerability exists in Android's Mediaserver component that can be triggered by a specially crafted file. The affected versions are Android 6.0, 6.0.1, 7.0, and 7.1.1 [1]. The vulnerability is tracked as Android ID A-33090864 [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted file that is processed by Mediaserver. The attacker does not require any special authentication or elevated privileges, as the file can be delivered through various means such as a malicious app or a web page [1]. The user may need to open or preview the file for the processing to occur.

Impact

Successful exploitation causes the Mediaserver to enter a state that leads to a device hang or reboot, resulting in a temporary denial of service. The impact is limited to availability, with no evidence of information disclosure or privilege escalation [1].

Mitigation

Google released patches for this vulnerability with the March 2017 Android Security Bulletin for all affected versions [1]. Users should apply the security update as soon as it is available from their device manufacturer or carrier. No workarounds are currently available aside from installing the update.