CVE-2017-6276

Vulnerability

The NVIDIA mediaserver component on Android contains a use-after-free vulnerability caused by an incorrect bounds check. This memory corruption bug can be triggered when processing specially crafted media files. The vulnerability affects Android devices using the NVIDIA mediaserver; the reference Android Security Bulletin for December 2017 lists the fix [1]. No specific media server version is given in the bulletin, but the advisory covers all impacted NVIDIA Android devices at that time.

Exploitation

An attacker requires local access to the device, either through a malicious application or by enticing a user to open a crafted media file. The incorrect bounds check allows the attacker to corrupt memory, leading to a use-after-free condition. No authentication is needed beyond the ability to execute code at the application level.

Impact

Successful exploitation enables unauthorized code execution within the mediaserver process, which runs with elevated privileges. This can lead to a full elevation of privileges, allowing the attacker to gain the same privileges as the mediaserver process, potentially including access to sensitive data or system-level control.

Mitigation

Google released a fix in the December 2017 Android Security Bulletin (2017-12-01) [1]. Users should apply the security patch level 2017-12-01 or later on their Android devices. No workaround is available; updating to a patched version is the only mitigation.