Published September 06, 2016 | Updated September 12, 2016
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware images have also been released to the Google Developer site. Security Patch Levels of September 06, 2016 or later address these issues. Refer to the documentation to learn how to check the security patch level. Supported Nexus devices will receive a single OTA update with the September 06, 2016 security patch level.
Partners were notified about the issues described in the bulletin on August 05, 2016 or earlier. Where applicable, source code patches for these issues have been released to the Android Open Source Project (AOSP) repository. This bulletin also includes links to patches outside of AOSP.
The most severe of these issues is a Critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.
We have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the Android and Google service mitigations section for details on the Android security platform protections and service protections such as SafetyNet, which improve the security of the Android platform.
We encourage all customers to accept these updates to their devices.
Announcements
- This bulletin has three security patch level strings to provide Android
partners with the flexibility to move more quickly to fix a subset of
vulnerabilities that are similar across all Android devices. See
Common questions and answers for
additional information:
- 2016-09-01: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-09-01 (and all previous security patch level strings) are addressed.
- 2016-09-05: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-09-01 and 2016-09-05 (and all previous security patch level strings) are addressed.
- 2016-09-06: Complete security patch level string, which addresses issues that were discovered after partners were notified of most issues in this bulletin. This security patch level string indicates that all issues associated with 2016-09-01, 2016-09-05, and 2016-09-06 (and all previous security patch level strings) are addressed.
- Supported Nexus devices will receive a single OTA update with the September 06, 2016 security patch level.
Android and Google service mitigations
This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.
- Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
- The Android Security team actively monitors for abuse with Verify Apps and SafetyNet, which are designed to warn users about Potentially Harmful Applications. Verify Apps is enabled by default on devices with Google Mobile Services, and is especially important for users who install applications from outside of Google Play. Device rooting tools are prohibited within Google Play, but Verify Apps warns users when they attempt to install a detected rooting application—no matter where it comes from. Additionally, Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove the detected application.
- As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as Mediaserver.
Acknowledgements
We would like to thank these researchers for their contributions:
- Cory Pruce of Carnegie Mellon University: CVE-2016-3897
- Gengjia Chen (@chengjia4574) and pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd.: CVE-2016-3869, CVE-2016-3865, CVE-2016-3866, CVE-2016-3867
- Hao Qin of Security Research Lab, Cheetah Mobile: CVE-2016-3863
- Jann Horn of Google Project Zero: CVE-2016-3885
- Jianqiang Zhao (@jianqiangzhao) and pjf of IceSword Lab, Qihoo 360: CVE-2016-3858
- Joshua Drake (@jduck): CVE-2016-3861
- Madhu Priya Murugan of CISPA, Saarland University: CVE-2016-3896
- Makoto Onuki of Google: CVE-2016-3876
- Mark Brand of Google Project Zero: CVE-2016-3861
- Max Spector of Android Security: CVE-2016-3888
- Max Spector and Quan To of Android Security: CVE-2016-3889
- Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3895
- Nathan Crandall (@natecray) of Tesla Motors Product Security Team: Discovery of additional issues related to CVE-2016-2446
- Oleksiy Vyalov of Google: CVE-2016-3890
- Oliver Chang of Google Chrome Security Team: CVE-2016-3880
- Peng Xiao, Chengming Yang, Ning You, Chao Yang, and Yang song, of Alibaba Mobile Security Group: CVE-2016-3859
- Ronald L. Loor Vargas (@loor_rlv) of TEAM Lv51: CVE-2016-3886
- Sagi Kedmi, IBM Security X-Force Researcher: CVE-2016-3873
- Scott Bauer (@ScottyBauer1): CVE-2016-3893, CVE-2016-3868, CVE-2016-3867
- Seven Shen (@lingtongshen) of TrendMicro: CVE-2016-3894
- Tim Strazzere (@timstrazz) of SentinelOne / RedNaga: CVE-2016-3862
- trotmaster (@trotmaster99): CVE-2016-3883
- Victor Chang of Google: CVE-2016-3887
- Vignesh Venkatasubramanian of Google: CVE-2016-3881
- Weichao Sun (@sunblate) of Alibaba Inc: CVE-2016-3878
- Wenke Dou, Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3870, CVE-2016-3871, CVE-2016-3872
- Wish Wu (吴潍浠) (@wish_wu) of Trend Micro Inc.: CVE-2016-3892
- Xingyu He (何星宇) (@Spid3r_) of Alibaba Inc: CVE-2016-3879
- Yacong Gu of TCA Lab, Institute of Software, Chinese Academy of Sciences: CVE-2016-3884
- Yuru Shao of University of Michigan Ann Arbor: CVE-2016-3898
2016-09-01 security patch level—Security vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-09-01 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Remote code execution vulnerability in LibUtils
A remote code execution vulnerability in LibUtils could enable an attacker using a specially crafted file to execute arbitrary code in the context of a privileged process. This issue is rated as Critical due to the possibility of remote code execution in applications that use this library.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3861 | A-29250543 [2] [3] [4] | Critical | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 9, 2016 |
Remote code execution vulnerability in Mediaserver
A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3862 | A-29270469 | Critical | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Jun 10, 2016 |
Remote code execution vulnerability in MediaMuxer
A remote code execution vulnerability in MediaMuxer could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses MediaMuxer.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3863 | A-29161888 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 6, 2016 |
Elevation of privilege vulnerability in Mediaserver
An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3870 | A-29421804 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 15, 2016 |
| CVE-2016-3871 | A-29422022 [2] [3] | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 15, 2016 |
| CVE-2016-3872 | A-29421675 [2] | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 15, 2016 |
Elevation of privilege vulnerability in device boot
An elevation of privilege during the boot sequence could enable a local malicious attacker to boot into safe mode even though it's disabled. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3875 | A-26251884 | High | None* | 6.0, 6.0.1 | Google internal |
* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.
Elevation of privilege vulnerability in Settings
An elevation of privilege in Settings could enable a local malicious attacker to boot into safe mode even though it's disabled. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3876 | A-29900345 | High | All Nexus | 6.0, 6.0.1, 7.0 | Google internal |
Denial of service vulnerability in Mediaserver
A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3899 | A-29421811 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 16, 2016 |
| CVE-2016-3878 | A-29493002 | High | All Nexus* | 6.0, 6.0.1 | Jun 17, 2016 |
| CVE-2016-3879 | A-29770686 | High | All Nexus* | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Jun 25, 2016 |
| CVE-2016-3880 | A-25747670 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Google internal |
| CVE-2016-3881 | A-30013856 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Google internal |
* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.
Elevation of privilege vulnerability in Telephony
An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to send unauthorized premium SMS messages. This issue is rated as Moderate because it could be used to gain elevated capabilities without explicit user permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3883 | A-28557603 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | May 3, 2016 |
Elevation of privilege vulnerability in Notification Manager Service
An elevation of privilege vulnerability in the Notification Manager Service could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate because it is a local bypass of user interaction requirements, such as access to functionality that would normally require either user initiation or user permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3884 | A-29421441 | Moderate | All Nexus | 6.0, 6.0.1, 7.0 | Jun 15, 2016 |
Elevation of privilege vulnerability in Debuggerd
An elevation of privilege vulnerability in the integrated Android debugger could enable a local malicious application to execute arbitrary code within the context of the Android debugger. This issue is rated as Moderate severity due to the possibility of local arbitrary code execution in a privileged process.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3885 | A-29555636 | Moderate | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 21, 2016 |
Elevation of privilege vulnerability in System UI Tuner
An elevation of privilege in the System UI Tuner could enable a local malicious user to modify protected settings when a device is locked. This issue is rated as Moderate because it is a local bypass of user permissions.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3886 | A-30107438 | Moderate | All Nexus | 7.0 | Jun 23, 2016 |
Elevation of privilege vulnerability in Settings
An elevation of privilege vulnerability in Settings could enable a local malicious application to bypass operating system protections for VPN settings. This issue is rated as Moderate because it could be used to gain access to data that is outside of the application’s permission levels.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3887 | A-29899712 | Moderate | All Nexus | 7.0 | Google internal |
Elevation of privilege vulnerability in SMS
An elevation of privilege vulnerability in SMS could enable a local attacker to send premium SMS messages prior to the device being provisioned. This is rated as Moderate due to the possibility of bypassing Factory Reset Protection, which should prevent the device from being used before it is set up.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3888 | A-29420123 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Google internal |
Elevation of privilege vulnerability in Settings
An elevation of privilege vulnerability in Settings could enable a local attacker to bypass the Factory Reset Protection and gain access to the device. This is rated as Moderate due to the possibility of bypassing Factory Reset Protection, which could lead to successfully resetting the device and erasing all its data.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3889 | A-29194585 [2] | Moderate | All Nexus | 6.0, 6.0.1, 7.0 | Google internal |
Elevation of privilege vulnerability in Java Debug Wire Protocol
An elevation of privilege vulnerability in the Java Debug Wire Protocol could enable a local malicious application to execute arbitrary code within the context of an elevated system application. This issue is rated as Moderate because it requires an uncommon device configuration.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3890 | A-28347842 [2] | Moderate | None* | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Google internal |
* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.
Information disclosure vulnerability in Mediaserver
An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3895 | A-29983260 | Moderate | All Nexus | 6.0, 6.0.1, 7.0 | Jul 4, 2016 |
Information disclosure vulnerability in AOSP Mail
An information disclosure vulnerability in AOSP Mail could enable a local malicious application to gain access to user’s private information. This issue is rated as Moderate because it could be used to improperly access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3896 | A-29767043 | Moderate | None* | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Jul 24, 2016 |
* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.
Information disclosure vulnerability in Wi-Fi
An information disclosure vulnerability in the Wi-Fi configuration could allow an application to access sensitive information. This issue is rated as Moderate because it could be used to access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3897 | A-25624963 [2] | Moderate | None* | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Nov 5, 2015 |
* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.
Denial of service vulnerability in Telephony
A denial of service vulnerability in the Telephony component could enable a local malicious application to prevent 911 TTY calls from a locked screen. This issue is rated as Moderate due to the possibility of a denial of service on a critical function.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3898 | A-29832693 | Moderate | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 28, 2016 |
2016-09-05 security patch level—Vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-09-05 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Elevation of privilege vulnerability in kernel security subsystem
An elevation of privilege vulnerability in the kernel security subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2014-9529 | A-29510361 | Critical | Nexus 5, Nexus 6, Nexus 9, Nexus Player, Android One | Jan 6, 2015 |
| CVE-2016-4470 | A-29823941 | Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player | June 15, 2016 |
Elevation of privilege vulnerability in kernel networking subsystem
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2013-7446 | A-29119002 | Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Nov 18, 2015 |
Elevation of privilege vulnerability in kernel netfilter subsystem
An elevation of privilege vulnerability in the kernel netfilter subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3134 | A-28940694 | Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Mar 9, 2016 |
Elevation of privilege vulnerability in kernel USB driver
An elevation of privilege vulnerability in the kernel USB driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3951 | A-28744625 | Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Apr 6, 2016 |
Elevation of privilege vulnerability in kernel sound subsystem
An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2014-4655 | A-29916012 | High | Nexus 5, Nexus 6, Nexus 9, Nexus Player | Jun 26, 2014 |
Elevation of privilege vulnerability in kernel ASN.1 decoder
An elevation of privilege vulnerability in the kernel ASN.1 decoder could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2053 | A-28751627 | High | Nexus 5X, Nexus 6P | Jan 25, 2016 |
Elevation of privilege vulnerability in Qualcomm radio interface layer
An elevation of privilege vulnerability in the Qualcomm radio interface layer could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3864 | A-28823714* QC-CR#913117 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Apr 29, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm subsystem driver
An elevation of privilege vulnerability in the Qualcomm subsystem driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3858 | A-28675151 QC-CR#1022641 |
High | Nexus 5X, Nexus 6P | May 9, 2016 |
Elevation of privilege vulnerability in kernel networking driver
An elevation of privilege vulnerability in the kernel networking driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-4805 | A-28979703 | High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9 | May 15, 2016 |
Elevation of privilege vulnerability in Synaptics touchscreen driver
An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3865 | A-28799389* | High | Nexus 5X, Nexus 9 | May 16, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm camera driver
An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3859 | A-28815326* QC-CR#1034641 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P | May 17, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm sound driver
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3866 | A-28868303* QC-CR#1032820 |
High | Nexus 5X, Nexus 6, Nexus 6P | May 18, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm IPA driver
An elevation of privilege vulnerability in the Qualcomm IPA driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3867 | A-28919863* QC-CR#1037897 |
High | Nexus 5X, Nexus 6P | May 21, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm power driver
An elevation of privilege vulnerability in the Qualcomm power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3868 | A-28967028* QC-CR#1032875 |
High | Nexus 5X, Nexus 6P | May 25, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Broadcom Wi-Fi driver
An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3869 | A-29009982* B-RB#96070 |
High | Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C | May 27, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in kernel eCryptfs filesystem
An elevation of privilege vulnerability in the kernel eCryptfs filesystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-1583 | A-29444228 Upstream kernel |
High | Pixel C | Jun 1, 2016 |
Elevation of privilege vulnerability in NVIDIA kernel
An elevation of privilege vulnerability in the NVIDIA kernel could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High severity because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3873 | A-29518457* N-CVE-2016-3873 |
High | Nexus 9 | Jun 20, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm Wi-Fi driver
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3874 | A-29944562 QC-CR#997797 [2] |
High | Nexus 5X | Jul 1, 2016 |
Denial of service vulnerability in kernel networking subsystem
A denial of service vulnerability in the kernel networking subsystem could enable an attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-1465 | A-29506807 | High | Nexus 5, Nexus 6, Nexus 9, Nexus Player, Pixel C, Android One | Feb 3, 2015 |
| CVE-2015-5364 | A-29507402 | High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Jun 30, 2015 |
Denial of service vulnerability in kernel ext4 file system
A denial of service vulnerability in the kernel ext4 file system could enable an attacker to cause a local permanent denial of service, which may require reflashing the operating system to repair the device. This issue is rated as High due to the possibility of local permanent denial of service.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-8839 | A-28760453* | High | Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Apr 4, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in Qualcomm SPMI driver
An information disclosure vulnerability in the Qualcomm SPMI driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3892 | A-28760543* QC-CR#1024197 |
Moderate | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P | May 13, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in Qualcomm sound codec
An information disclosure vulnerability in the Qualcomm sound codec could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3893 | A-29512527 QC-CR#856400 |
Moderate | Nexus 6P | Jun 20, 2016 |
Information disclosure vulnerability in Qualcomm DMA component
An information disclosure vulnerability in the Qualcomm DMA component could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3894 | A-29618014* QC-CR#1042033 |
Moderate | Nexus 6 | Jun 23, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in kernel networking subsystem
An information disclosure vulnerability in the kernel networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-4998 | A-29637687 Upstream kernel [2] |
Moderate | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Jun 24, 2016 |
Denial of service vulnerability in kernel networking subsystem
A denial of service vulnerability in the kernel networking subsystem could enable an attacker to block access to Wi-Fi capabilities.This issue is rated as Moderate due to the possibility of a temporary remote denial of service of the Wi-Fi capabilities.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-2922 | A-29409847 | Moderate | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Apr 4, 2015 |
Vulnerabilities in Qualcomm components
The table below contains security vulnerabilities affecting Qualcomm components, potentially including the bootloader, camera driver, character driver, networking, sound driver, and video driver.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2469 | QC-CR#997025 | High | None | Jun 2016 |
| CVE-2016-2469 | QC-CR#997015 | Moderate | None | Jun 2016 |
2016-09-06 security patch level—Vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-09-06 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Elevation of privilege vulnerability in kernel shared memory subsystem
An elevation of privilege vulnerability in the kernel shared memory subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-5340 | A-30652312 QC-CR#1008948 |
Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Jul 26, 2016 |
Elevation of privilege vulnerability in Qualcomm networking component
An elevation of privilege vulnerability in the Qualcomm networking component could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2059 | A-27045580 QC-CR#974577 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Feb 4, 2016 |
Common Questions and Answers
This section answers common questions that may occur after reading this bulletin.
1. How do I determine if my device is updated to address these issues?
Security Patch Levels of 2016-09-01 or later address all issues associated with the 2016-09-01 security patch string level. Security Patch Levels of 2016-09-05 or later address all issues associated with the 2016-09-05 security patch string level. Security Patch Levels of 2016-09-06 or later address all issues associated with the 2016-09-06 security patch string level. Refer to the help center for instructions on how to check the security patch level. Device manufacturers that include these updates should set the patch string level to: [ro.build.version.security_patch]:[2016-09-01], [ro.build.version.security_patch]:[2016-09-05], or [ro.build.version.security_patch]:[2016-09-06].
2. Why does this bulletin have three security patch level strings?
This bulletin has three security patch level strings so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level string.
Devices that use the September 6, 2016 security patch level or newer must include all applicable patches in this (and previous) security bulletins. This patch level was created to addresses issues that were discovered after partners were first notified of most issues in this bulletin.
Devices that use September 5, 2016 security patch level must include all issues associated with that security patch level, the September 1, 2016 security patch level and fixes for all issues reported in previous security bulletins. Devices that use the September 5, 2016 security patch level may also include a subset of fixes associated with the September 6, 2016 security patch level.
Devices that use September 1, 2016 security patch level must include all issues associated with that security patch level as well as fixes for all issues reported in previous security bulletins. Devices that use the September 1, 2016 security patch level may also include a subset of fixes associated with the September 5, 2016 and September 6, 2016 security patch levels.
3. How do I determine which Nexus devices are affected by each issue?
In the 2016-09-01, 2016-09-05, and 2016-09-06 security vulnerability details sections, each table has an Updated Nexus devices column that covers the range of affected Nexus devices updated for each issue. This column has a few options:
- All Nexus devices: If an issue affects all Nexus devices, the table will have “All Nexus” in the Updated Nexus devices column. “All Nexus” encapsulates the following supported devices: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Android One, Nexus Player, and Pixel C.
- Some Nexus devices: If an issue doesn’t affect all Nexus devices, the affected Nexus devices are listed in the Updated Nexus devices column.
- No Nexus devices: If no Nexus devices running Android 7.0 are affected by the issue, the table will have “None” in the Updated Nexus devices column.
4. What do the entries in the references column map to?
Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. These prefixes map as follows:
| Prefix | Reference |
|---|---|
| A- | Android bug ID |
| QC- | Qualcomm reference number |
| M- | MediaTek reference number |
| N- | NVIDIA reference number |
| B- | Broadcom reference number |
Revisions
- September 06, 2016: Bulletin published.
- September 07, 2016: Bulletin revised to include AOSP links.
- September 12, 2016: Bulletin revised to update attribution for CVE-2016-3861 and remove CVE-2016-3877.