CVE-2018-3563

Vulnerability

The vulnerability resides in the apr_cb_func function within the APR (Asynchronous Protocol Router) subsystem of Qualcomm components used in Android for MSM, Firefox OS for MSM, and QRD Android. An untrusted pointer dereference allows an attacker to control a function pointer, leading to arbitrary code execution. The affected versions include all Android releases from CAF using the Linux kernel before the security patch level 2018-04-05 [1].

Exploitation

The attacker requires local access to the device and the ability to pass a crafted packet to the APR subsystem. No additional authentication or user interaction is needed beyond that. The exploitation involves sending a specially crafted APR message that triggers the untrusted pointer dereference in apr_cb_func [1].

Impact

Successful exploitation results in arbitrary code execution in the context of the kernel. This can lead to full compromise of the device's confidentiality, integrity, and availability, including the ability to install malicious code, access sensitive data, or perform other unauthorized actions [1].

Mitigation

The issue is fixed in the Android security patch level 2018-04-05. Users should update their devices to a security patch date of April 2018 or later [1].