CVE-2018-3564

Vulnerability

The vulnerability resides in the FastRPC driver for Qualcomm components in Android for MSM, Firefox OS for MSM, and QRD Android. It is a Use After Free condition that occurs when a mapping operation on the remote processor fails. The affected kernel versions are those included in Android security patch levels prior to 2018-06-05. [1]

Exploitation

An attacker requires local access to the device with the ability to trigger the FastRPC driver code path that causes a mapping failure. By repeatedly initiating mapping requests that are designed to fail, the attacker can cause the driver to free a memory region while it is still referenced, leading to a Use After Free condition. No user interaction beyond normal system usage is required for the triggering sequence. [1]

Impact

Successful exploitation can result in a local elevation of privilege (EoP), potentially allowing an attacker to execute arbitrary code in the kernel context. The scope of compromise is limited to the affected Android device, but the attacker could gain full control over the system's kernel operations. [1]

Mitigation

The vulnerability is addressed in the Android security patch level 2018-06-05, which was included in the Pixel/Nexus Security Bulletin published on June 1, 2018. Users should apply the June 2018 security update or later. No workarounds are available for unpatched devices. [1]