Issues in the TSC, TSPP2, and BusPM Drivers (CVE-2015-0573, CVE-2016-2441, CVE-2016-2442)

Release Date:

May 17, 2016

Affected Projects:

Android for MSMFirefox OS for MSMQRD Android

Advisory ID:

QCIR-2016-00009-1

CVE ID(s):

CVE-2015-0573CVE-2016-2441CVE-2016-2442

Summary:

CVE-2015-0573 When the TSC_GET_CARD_STATUS ioctl is invoked on the TSC driver, the argument is used without verifying that it is a user space address. CVE-2016-2441 When the MSM_BUSPM_IOC_RD_PHYS_ADDR ioctl is invoked on the BusPM driver, the argument is used without verifying that it is a user space address. CVE-2016-2442 When the memory map ioctl is invoked on the BusPM driver, memory is mapped in user space without verifying that the caller can access the memory.

Access Vector: Local

Security Risk: High

Access Vector: Local

Affected Versions:

All Android releases from CAF using the Linux kernel.

Patch:

We advise customers to apply the following patches:

Individual Patches

• CVE-2015-0573: here
• CVE-2016-2441: here
• CVE-2016-2442: here

Acknowledgement:

Qualcomm Innovation Center, Inc. (QuIC) thanks Chiachih Wu (@chiachih_wu) and Xuxian Jiang of C0RE Team for reporting CVE-2015-0573 and working with QuIC to help improve Android device security. Qualcomm Innovation Center, Inc. (QuIC) thanks Chiachih Wu (@chiachih_wu) and Xuxian Jiang of C0RE Team, and Jianqiang Zhao (@jianqiangzhao) and pjf (weibo.com/jfpan) of IceSword Lab, Qihoo 360 Technology Co. Ltd, for reporting CVE-2016-2441 and CVE-2016-2442 and working with QuIC to help improve Android device security.

Revisions:

Initial revision

Contact: