CVE-2017-14877

Vulnerability

The vulnerability resides in the IPA (IP Accelerator) driver used in Android for MSM, Firefox OS for MSM, and QRD Android. While the driver processes IOCTL commands, there is no mutex lock protecting the allocated memory. Affected builds are those before 2017-08-31. Specifically, if one thread sends an IPA_IOC_QUERY_RT_TBL_INDEX ioctl command while another thread sends IPA_IOC_DEL_RT_RULE, a race condition leads to a use-after-free condition [1].

Exploitation

To exploit this vulnerability, an attacker must first gain local access to the device and be able to execute code that can send the two specific IOCTL commands concurrently. The attacker needs no special privileges beyond normal user access. By racing the query and delete operations, the attacker can trigger the use-after-free, allowing the freed memory to be reused by a different object [1].

Impact

Successful exploitation results in arbitrary code execution in the kernel context. The attacker gains the ability to execute arbitrary code with kernel privileges, leading to full compromise of the device's security. The CIA impact is high as confidentiality, integrity, and availability can all be compromised [1].

Mitigation

The vulnerability was fixed in the Android security bulletin for February 2018. Devices that have received the 2018-02-01 security patch level are protected. The fix involves adding proper mutex locking to the IPA driver IOCTL handling code [1]. There is no known listing in CISA's KEV.