CVE-2017-15856

Vulnerability

A race condition exists in the processing of the power stats debug file (/proc/power_stats) when reading status, resulting in a potential double free. This vulnerability affects Android releases from Code Aurora Forum (CAF) using the Linux kernel, including Android for MSM, Firefox OS for MSM, and QRD Android, before the security patch level of 2018-06-05 [1].

Exploitation

To exploit this vulnerability, an attacker must be able to trigger a race condition while reading the power stats debug file. This likely requires local access to the device and the ability to simultaneously read and write to the debug file, or to race the file operations. The exact steps are not detailed in the available references.

Impact

Successful exploitation of the double free condition can lead to memory corruption, potentially allowing an attacker to achieve arbitrary code execution or cause a system crash (denial of service). The impact is constrained to the kernel context.

Mitigation

The vulnerability is patched in the Android security patch level of 2018-06-05, as released in the Pixel/Nexus Security Bulletin of June 2018 [1]. Users should ensure their devices receive the latest security updates from their vendors.