Published November 02, 2015
We have released a security update to Nexus devices through an over-the-air (OTA) update as part of our Android Security Bulletin Monthly Release process. The Nexus firmware images have also been released to the Google Developer site. Builds LMY48X or later and Android Marshmallow with Security Patch Level of November 1, 2015 or later address these issues. Refer to the Common Questions and Answers section for more details.
Partners were notified about these issues on October 5, 2015 or earlier. Source code patches for these issues will be released to the Android Open Source Project (AOSP) repository over the next 48 hours. We will revise this bulletin with the AOSP links when they are available.
The most severe of these issues is a Critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.
We have had no reports of active customer exploitation of these newly reported issues. Refer to the Mitigations section for details on the Android security platform protections and service protections such as SafetyNet, which improve the security of the Android platform. We encourage all customers to accept these updates to their devices.
Mitigations
This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities can be successfully exploited on Android.
- Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
- The Android Security team is actively monitoring for abuse with Verify Apps and SafetyNet which will warn about potentially harmful applications about to be installed. Device rooting tools are prohibited within Google Play. To protect users who install applications from outside of Google Play, Verify Apps is enabled by default and will warn users about known rooting applications. Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove any such applications.
- As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as mediaserver.
Acknowledgements
We would like to thank these researchers for their contributions:
- Abhishek Arya, Oliver Chang and Martin Barbella, Google Chrome Security Team: CVE-2015-6608
- Daniel Micay (daniel.micay@copperhead.co) at Copperhead Security: CVE-2015-6609
- Dongkwan Kim of System Security Lab, KAIST (dkay@kaist.ac.kr): CVE-2015-6614
- Hongil Kim of System Security Lab, KAIST (hongilk@kaist.ac.kr): CVE-2015-6614
- Jack Tang of Trend Micro (@jacktang310): CVE-2015-6611
- Peter Pi of Trend Micro: CVE-2015-6611
- Natalie Silvanovich of Google Project Zero: CVE-2015-6608
- Qidan He (@flanker_hqd) and Wen Xu (@antlr7) from KeenTeam (@K33nTeam, http://k33nteam.org/): CVE-2015-6612
- Guang Gong (龚广) (@oldfresher, higongguang@gmail.com) of Qihoo 360 Technology CC o.Ltd: CVE-2015-6612
- Seven Shen of Trend Micro: CVE-2015-6610
Security Vulnerability Details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2015-11-01 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated bug, severity, affected versions, and date reported. Where available, we’ve linked the AOSP change that addressed the issue to the bug ID. When multiple changes relate to a single bug, additional AOSP references are linked to numbers following the bug ID.
Remote Code Execution Vulnerabilities in Mediaserver
During media file and data processing of a specially crafted file, vulnerabilities in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process.
The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.
This issue is rated as a Critical severity due to the possibility of remote code execution within the context of the mediaserver service. The mediaserver service has access to audio and video streams as well as access to privileges that third-party apps cannot normally access.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6608 | ANDROID-19779574 | Critical | 5.0, 5.1, 6.0 | Google Internal |
| ANDROID-23680780 | ||||
| ANDROID-23876444 | ||||
| ANDROID-23881715 | Critical | 4.4, 5.0, 5.1, 6.0 | Google Internal | |
| ANDROID-14388161 | Critical | 4.4 and 5.1 | Google Internal | |
| ANDROID-23658148 | Critical | 5.0, 5.1, 6.0 | Google Internal |
Remote Code Execution Vulnerability in libutils
A vulnerability in libutils, a generic library, can be exploited during audio file processing. This vulnerability could allow an attacker, during processing of a specially crafted file, to cause memory corruption and remote code execution.
The affected functionality is provided as an API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media. This issue is rated as a Critical severity issue due to the possibility of remote code execution in a privileged service. The affected component has access to audio and video streams as well as access to privileges that third-party apps cannot normally access.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6609 | ANDROID-22953624 [2] | Critical | 6.0 and below | Aug 3, 2015 |
Information Disclosure Vulnerabilities in Mediaserver
There are information disclosure vulnerabilities in mediaserver that can permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6611 | ANDROID-23905951 [2] [3] | High | 6.0 and below | Sep 07, 2015 |
| ANDROID-23912202* | ||||
| ANDROID-23953967* | ||||
| ANDROID-23696300 | High | 6.0 and below | Aug 31, 2015 | |
| ANDROID-23600291 | High | 6.0 and below | Aug 26, 2015 | |
| ANDROID-23756261 [2] | High | 6.0 and below | Aug 26, 2015 | |
| ANDROID-23540907 [2] | High | 5.1 and below | Aug 25, 2015 | |
| ANDROID-23541506 | High | 6.0 and below | Aug 25, 2015 | |
| ANDROID-23284974* | ||||
| ANDROID-23542351* | ||||
| ANDROID-23542352* | ||||
| ANDROID-23515142 | High | 5.1 and below | Aug 19, 2015 |
* The patch for this bug is included in other provided AOSP links.
Elevation of Privilege Vulnerability in libstagefright
There is an elevation of privilege vulnerability in libstagefright that can enable a local malicious application to cause memory corruption and arbitrary code execution within the context of the mediaserver service. While this issue would normally be rated Critical, we have assessed this issue as High severity because of a lower likelihood that it can be exploited remotely.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6610 | ANDROID-23707088 [2] | High | 6.0 and below | Aug 19, 2015 |
Elevation of Privilege Vulnerability in libmedia
There is a vulnerability in libmedia that can enable a local malicious application to execute arbitrary code within the context of the mediaserver service. This issue is rated as High severity because it can be used to access privileges which are not directly accessible to a third-party application.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6612 | ANDROID-23540426 | High | 6.0 and below | Aug 23, 2015 |
Elevation of Privilege Vulnerability in Bluetooth
There is a vulnerability in Bluetooth that can enable a local application to send commands to a listening debug port on the device. This issue is rated as High severity because it can be used to gain elevated capabilities, such as Signature or SignatureOrSystem permissions privileges, which are not accessible to a third-party application.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6613 | ANDROID-24371736 | High | 6.0 | Google Internal |
Elevation Of Privilege Vulnerability in Telephony
A vulnerability in the Telephony component that can enable a local malicious application to pass unauthorized data to the restricted network interfaces, potentially impacting data charges. It could also prevent the device from receiving calls as well as allowing an attacker to control the mute settings of calls. This issue is rated as Moderate severity because it can be used to improperly gain “dangerous” permissions.
| CVE | Bug(s) with AOSP links | Severity | Affected versions | Date reported |
|---|---|---|---|---|
| CVE-2015-6614 | ANDROID-21900139 [2] [3] | Moderate | 5.0, 5.1 | Jun 8, 2015 |
Common Questions and Answers
This section will review answers to common questions that may occur after reading this bulletin.
1. How do I determine if my device is updated to address these issues?
Builds LMY48X or later and Android Marshmallow with Security Patch Level of November 1, 2015 or later address these issues. Refer to the Nexus documentation for instructions on how to check the security patch level. Device manufacturers that include these updates should set the patch string level to: [ro.build.version.security_patch]:[2015-11-01]
Revisions
- November 02, 2015: Originally Published