Elevation of Privilege Vulnerabilities in Qualcomm Video Driver (CVE-2016-2465, CVE-2016-2489)

Release Date:

July 12, 2016

Affected Projects:

Android for MSMFirefox OS for MSMQRD Android

Advisory ID:

QCIR-2016-00023-1

CVE ID(s):

CVE-2016-2465CVE-2016-2489

Summary:

CVE-2016-2465 In function mdss_debug_perf_mode_read, a too large user-supplied value is not checked against a buffer size, resulting in writing beyond the bounds of the buffer. Access Vector: Local Security Risk: High Vulnerability: CWE-129 Improper Validation of Array Index Affected Versions All Android releases from CAF using the Linux kernel. CVE-2016-2489 In function mdss_debug_perf_panic_write, a too large user-supplied value is not checked against a buffer size, resulting in writing beyond the bounds of the buffer. Access Vector: Local Security Risk: Medium Vulnerability: CWE-120 Buffer Copy Without Checking Size of Input ('Classic Buffer Overflow')

Access Vector: Local

Security Risk:

Access Vector: Local

Affected Versions:

All Android releases from CAF using the Linux kernel.

Patch:

We advise customers to apply the following patches:

Individual Patches

• CVE-2016-2465 & CVE-2016-2489: https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=240f3bd82840fe6df7989339e465e9558f42fb85

NOTE: The single patch will fix both issues (CVE-2016-2465 & CVE-2016-2489)

Acknowledgement:

These issues were reported to Google by a security researcher. Qualcomm Innovation Center, Inc. (QuIC) thanks Google for bringing these issues to our attention.

Revisions:

Initial revision

Contact: