CVE-2017-11016

Vulnerability

In Android for MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, a stale pointer is left uncleared when memory allocation fails while creating a calibration block in create_cal_block. This stale pointer can later be dereferenced, leading to a use-after-free condition. The vulnerability affects devices with security patch levels before 2017-12-05 [1].

Exploitation

An attacker needs local execution privileges (e.g., through an app) to trigger the vulnerable code path. The exploitation requires specific conditions where memory allocation fails during the calibration block creation, causing a stale pointer to remain. The attacker would then need to manipulate the freed memory to achieve code execution.

Impact

Successful exploitation could lead to arbitrary code execution within the context of the kernel, allowing the attacker to take control of the affected device. This would result in a complete compromise of confidentiality, integrity, and availability.

Mitigation

The vulnerability was fixed in Android security patch level 2017-12-05. Users should ensure their device is updated to this patch level or later through an over-the-air (OTA) update [1].