Published March 18, 2016
Android Security Advisories are supplemental to the Nexus Security Bulletins. Refer to our summary page for more information about Security Advisories.
Summary
Google has become aware of a rooting application using an unpatched local elevation of privilege vulnerability in the kernel on some Android devices (CVE-2015-1805). For this application to affect a device, the user must first install it. Google already blocks installation of rooting applications that use this vulnerability — both within Google Play and outside of Google Play — using Verify Apps, and have updated our systems to detect applications that use this specific vulnerability.
To provide a final layer of defense for this issue, partners were provided with a patch for this issue on March 16, 2016. Nexus updates are being created and will be released within a few days. Source code patches for this issue have been released to the Android Open Source Project (AOSP) repository.
Background
This is a known issue in the upstream Linux kernel that was fixed in April 2014 but wasn't called out as a security fix and assigned CVE-2015-1805 until February 2, 2015. On February 19, 2016, C0RE Team notified Google that the issue could be exploited on Android and a patch was developed to be included in an upcoming regularly scheduled monthly update.
On March 15, 2016 Google received a report from Zimperium that this vulnerability had been abused on a Nexus 5 device. Google has confirmed the existence of a publicly available rooting application that abuses this vulnerability on Nexus 5 and Nexus 6 to provide the device user with root privileges.
This issue is rated as a Critical severity issue due to the possibility of a local privilege escalation and arbitrary code execution leading to local permanent device compromise.
Scope
This advisory applies to all unpatched Android devices on kernel versions 3.4, 3.10 and 3.14, including all Nexus devices. Android devices using Linux kernel version 3.18 or higher are not vulnerable.
Mitigations
The following are mitigations that reduce the likelihood users are impacted by this issue:
- Verify Apps has been updated to block the installation of applications that we have learned are attempting to exploit this vulnerability both within and outside of Google Play.
- Google Play does not allow rooting applications, like the one seeking to exploit this issue.
- Android devices using Linux kernel version 3.18 or higher are not vulnerable.
Acknowledgements
Android would like to thank the C0RE Team and Zimperium for their contributions to this advisory.
Suggested actions
Android encourages all users to accept updates to their devices when they are available.
Fixes
Google has released a fix in the AOSP repository for multiple kernel versions. Android partners have been notified of these fixes and are encouraged to apply them. If further updates are required, Android will publish them directly to AOSP.
| Kernel Version | Patch |
|---|---|
| 3.4 | AOSP patch |
| 3.10 | AOSP patch |
| 3.14 | AOSP patch |
| 3.18+ | Patched in public Linux kernel |
Common questions and answers
1. What's the problem?
An elevation of privilege vulnerability in the kernel could enable a local malicious application to execute arbitrary code in the kernel. This issue is rated as a Critical severity due to the possibility of a local permanent device compromise and the device would possibly need to be repaired by re-flashing the operating system.
2. How would an attacker seek to exploit this issue?
Users who install an application that seeks to exploit this issue are at risk. Rooting applications (like the one that is exploiting this issue) are prohibited in Google Play, and Google is blocking the installation of this application outside of Google Play through Verify Apps. An attacker would need to convince a user to manually install an affected application.
3. Which devices could be affected?
Google has confirmed that this exploit works on Nexus 5 and 6; however all unpatched versions of Android contain the vulnerability.
4. Has Google seen evidence of this vulnerability being abused?
Yes, Google has seen evidence of this vulnerability being abused on a Nexus 5 using a publicly available rooting tool. Google has not observed any exploitation that would be classified as “malicious.”
5. How will you be addressing this issue?
Google Play prohibits apps attempting to exploit this issue. Similarly, Verify Apps blocks the installation of apps from outside of Google Play that attempt to exploit this issue. Google Nexus devices will also be patched as soon as an update is ready and we've notified Android partners so they can release similar updates.
6. How do I know if I have a device that contains a fix for this issue?
Android has provided two options to our partners to communicate that their devices are not vulnerable to this issue. Android devices with a security patch level of March 18, 2016 are not vulnerable. Android devices with a security patch level of April 2, 2016 and later are not vulnerable to this issue. Refer to this article for instructions on how to check the security patch level.
Revisions
- March 18, 2016: Advisory published.