Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code.
These two vulnerabilities combined can lead to unintended root access.
Did anybody witnessed attacks based on these vulnerabilities in the real world although the disclosure with more details will be late May 2016?
TrendMicro Report: Link
@Wish_Wu recently did a demonstration of these exact security vulnerabilities to full exploitation at the HITBSecConf in Amsterdam.
Here is the slide deck.
The bugs involve the perf_event_open capabilities shipped in many Android OSes including the recent Nexus line of phones as well as many Samsung Galaxy and LG Android phones of recent note. Wish_Wu goes over which ones are likely in the prezo above.
CyanogenMod also reviewed these vulnerabilities.
There is also additional detail on CVE-2016-0819 including Qualcomm patch (information here).
By searching for the Android IDs in Wish Wu's presentation, you can also see the Android OS and other CyanogenMod patches. The presentation also goes over some additional fuzzing suites that will aid in exploit development.
This kind of issue documented as “allows attackers to gain privileges via a crafted application“ is published a few times per month. Similar circumstances are usually also part of the monthly patch releases of Apple iOS too.
Exact details are often missing. But in most cases it is necessary that an attacker is able to run his own code on the device. This can be done as part of a locally installed App. In a real-world scenario this would require an user to download, install and launch a malicious App.
Because Apple has established some kind of quality testing of Apps published in their AppStore, the chances of a successful distribution after disclosure and patching of an issue is rather small.
But in the Android world a comparable mechanism is missing. There are documented incidents of successful exploitation. But targeted attacks approach their victims usually with a side-install or a local exploitation (e.g. by police enforcement or intelligence services after getting physical access to a device). Broad infections would reveal the possibilities and hurt such operations.
