CVE-2017-18129

Vulnerability

In the Qualcomm internet protocol accelerator (IPA) driver used in Snapdragon Automobile and Snapdragon Mobile platforms (MDM9206, MDM9607, SD 845, MSM8996, MSM8998), IPA channels assigned to one security domain can be controlled from a different domain. This flaw exists in Android builds before the 2018-04-05 security patch level [1] and allows cross-domain channel manipulation.

Exploitation

An attacker with local access to a device running the vulnerable code, and the ability to execute code within one security domain, can exploit the missing domain isolation to send IPA channel commands that belong to another domain. No additional authentication or user interaction is required beyond the attacker already having code execution in the source domain [1].

Impact

Successful exploitation enables an attacker to perform operations on IPA channels that belong to a different security domain, which can result in privilege escalation relative to the target domain. The attacker may gain unauthorized access to network data flows processed by the IPA, leading to information disclosure or disruption of services [1].

Mitigation

The issue was fixed in the Android security patch level of 2018-04-05 [1]. Users should ensure their devices have received the April 2018 or later Android security updates. No workaround is available for unpatched devices.