CVE-2015-9157

Summary

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in widevine_dash_cmd_handler(), rsp buffers are passed off to widevine commands. These rsp buffers have values in them, such as buffer lengths, that need to be validated to ensure that no buffer overflow/over-reads happen. However, rsp buffers are not always in locked memory, meaning a time-of-check, time-of-use issue can occur where we check that the value is valid, but then a race condition occurs where this memory is swapped out with a different, possibly out of range, value.

Affected Software

Weaknesses

• Time-of-check Time-of-use (TOCTOU) Race Condition in Core.

ADP Enrichment

CVE Program Container

Additional References

• https://source.android.com/security/bulletin/2018-04-01
• http://www.securityfocus.com/bid/103671

References

• https://source.android.com/security/bulletin/2018-04-01
• http://www.securityfocus.com/bid/103671

• ←Previous
• Next→