Integer Overflow in Android LK aboot Bootloader Code (CVE-2016-3850)

Release Date:

August 15, 2016

Affected Projects:

Android for MSMFirefox OS for MSMQRD Android

Advisory ID:

QCIR-2016-00032-1

CVE ID(s):

CVE-2016-3850

Summary:

The following security vulnerabilities have been identified in QuIC-authored Android bootloader code. CVE-2016-3850 During boot, if the image contains large header fields, an integer overflow leads to accessing unknown region of the memory, which ultimately results in a device crash.

Access Vector: Local

Security Risk: Critical

Access Vector: Local

Affected Versions:

All Android releases from CAF using the Linux kernel.

Patch:

We advise customers to apply the following patches:

Individual Patches

• CVE-2016-3850: https://source.codeaurora.org/quic/la//kernel/lk/commit/?id=9a59b04c8ed8b57537f2f3cbcb06645575f64ac1

Note: This issue has been published in the Android Security Bulletin—August 2016 (https://source.android.com/security/bulletin/2016-08-01.html)

Acknowledgement:

Revisions:

Initial revision

Contact:

security-advisory@quicinc.com