Issues in the TSC, TSPP2, and BusPM Drivers (CVE-2015-0573, CVE-2016-2441, CVE-2016-2442)

Release Date: 
May 17, 2016
Advisory ID: 
QCIR-2016-00009-1
Summary: 

CVE-2015-0573
When the TSC_GET_CARD_STATUS ioctl is invoked on the TSC driver, the argument is used without verifying that it is a user space address.

Access Vector: Local
Security Risk: High
Vulnerability: CWE-822 (Untrusted Pointer Dereference)

CVE-2016-2441
When the MSM_BUSPM_IOC_RD_PHYS_ADDR ioctl is invoked on the BusPM driver, the argument is used without verifying that it is a user space address.

Access Vector: Local
Security Risk: High
Vulnerability: CWE-822 (Untrusted Pointer Dereference)

CVE-2016-2442
When the memory map ioctl is invoked on the BusPM driver, memory is mapped in user space without verifying that the caller can access the memory.

Access Vector: Local
Security Risk: High
Vulnerability: CWE-822 (Untrusted Pointer Dereference)

Affected Versions:
All Android releases from CAF using the Linux kernel.

Patch: 

We advise customers to apply the following patches:

    Individual Patches
  • CVE-2015-0573: here
  • CVE-2016-2441: here
  • CVE-2016-2442: here
Acknowledgement: 

Qualcomm Innovation Center, Inc. (QuIC) thanks Chiachih Wu (@chiachih_wu) and Xuxian Jiang of C0RE Team for reporting CVE-2015-0573 and working with QuIC to help improve Android device security.

Qualcomm Innovation Center, Inc. (QuIC) thanks Chiachih Wu (@chiachih_wu) and Xuxian Jiang of C0RE Team, and Jianqiang Zhao (@jianqiangzhao) and pjf (weibo.com/jfpan) of IceSword Lab, Qihoo 360 Technology Co. Ltd, for reporting CVE-2016-2441 and CVE-2016-2442 and working with QuIC to help improve Android device security.

Revisions: 

Initial Revision

Contact: 
security-advisory@quicinc.com