CVE-2017-0684

Vulnerability

The vulnerability resides in the Android media framework and affects Android versions 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2 [1]. An elevation of privilege vulnerability exists that can be exploited by a crafted media file processed by the vulnerable code path. The specific component and conditions required for reachability are not detailed in the available references.

Exploitation

An attacker needs local access to the device and user interaction to process a specially crafted media file. The exact sequence of steps is not disclosed in the available references.

Impact

Successful exploitation could lead to elevation of privilege [1], allowing an attacker to execute arbitrary code in the context of the media service or gain higher privileges on the device. The full scope of compromise, including the specific privilege level, is not detailed in the available references.

Mitigation

Google released a fix in the July 2017 Android Security Bulletin [1]. Users should apply the available security update to their devices. No workaround is provided in the bulletin.