The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which allows attackers to gain privileges via a crafted application.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Android-msm | Codeaurora | 2.6.29 (including) | 2.6.29 (including) |
| Android-msm | Codeaurora | 3.2.54 (including) | 3.2.54 (including) |
| Android-msm | Codeaurora | 3.2.55 (including) | 3.2.55 (including) |
| Android-msm | Codeaurora | 3.2.56 (including) | 3.2.56 (including) |
| Android-msm | Codeaurora | 3.2.57 (including) | 3.2.57 (including) |
| Android-msm | Codeaurora | 3.2.58 (including) | 3.2.58 (including) |
| Android-msm | Codeaurora | 3.2.59 (including) | 3.2.59 (including) |
| Android-msm | Codeaurora | 3.2.60 (including) | 3.2.60 (including) |
| Android-msm | Codeaurora | 3.2.61 (including) | 3.2.61 (including) |
| Android-msm | Codeaurora | 3.2.62 (including) | 3.2.62 (including) |
| Android-msm | Codeaurora | 3.4.72 (including) | 3.4.72 (including) |
| Android-msm | Codeaurora | 3.4.73 (including) | 3.4.73 (including) |
| Android-msm | Codeaurora | 3.4.74 (including) | 3.4.74 (including) |
| Android-msm | Codeaurora | 3.4.75 (including) | 3.4.75 (including) |
| Android-msm | Codeaurora | 3.4.76 (including) | 3.4.76 (including) |
| Android-msm | Codeaurora | 3.4.77 (including) | 3.4.77 (including) |
| Android-msm | Codeaurora | 3.4.78 (including) | 3.4.78 (including) |
| Android-msm | Codeaurora | 3.4.79 (including) | 3.4.79 (including) |
| Android-msm | Codeaurora | 3.4.80 (including) | 3.4.80 (including) |
| Android-msm | Codeaurora | 3.4.81 (including) | 3.4.81 (including) |
| Android-msm | Codeaurora | 3.4.82 (including) | 3.4.82 (including) |
| Android-msm | Codeaurora | 3.4.83 (including) | 3.4.83 (including) |
| Android-msm | Codeaurora | 3.4.84 (including) | 3.4.84 (including) |
| Android-msm | Codeaurora | 3.4.85 (including) | 3.4.85 (including) |
| Android-msm | Codeaurora | 3.4.86 (including) | 3.4.86 (including) |
| Android-msm | Codeaurora | 3.4.87 (including) | 3.4.87 (including) |
| Android-msm | Codeaurora | 3.4.88 (including) | 3.4.88 (including) |
| Android-msm | Codeaurora | 3.4.89 (including) | 3.4.89 (including) |
| Android-msm | Codeaurora | 3.4.90 (including) | 3.4.90 (including) |
| Android-msm | Codeaurora | 3.4.91 (including) | 3.4.91 (including) |
| Android-msm | Codeaurora | 3.4.92 (including) | 3.4.92 (including) |
| Android-msm | Codeaurora | 3.4.93 (including) | 3.4.93 (including) |
| Android-msm | Codeaurora | 3.4.94 (including) | 3.4.94 (including) |
| Android-msm | Codeaurora | 3.4.95 (including) | 3.4.95 (including) |
| Android-msm | Codeaurora | 3.4.96 (including) | 3.4.96 (including) |
| Android-msm | Codeaurora | 3.4.97 (including) | 3.4.97 (including) |
| Android-msm | Codeaurora | 3.4.98 (including) | 3.4.98 (including) |
| Android-msm | Codeaurora | 3.4.99 (including) | 3.4.99 (including) |
| Android-msm | Codeaurora | 3.4.100 (including) | 3.4.100 (including) |
| Android-msm | Codeaurora | 3.4.101 (including) | 3.4.101 (including) |
| Android-msm | Codeaurora | 3.4.102 (including) | 3.4.102 (including) |
| Android-msm | Codeaurora | 3.4.103 (including) | 3.4.103 (including) |
| Android-msm | Codeaurora | 3.10 (including) | 3.10 (including) |
| Android-msm | Codeaurora | 3.10.22 (including) | 3.10.22 (including) |
| Android-msm | Codeaurora | 3.10.23 (including) | 3.10.23 (including) |
| Android-msm | Codeaurora | 3.10.24 (including) | 3.10.24 (including) |
| Android-msm | Codeaurora | 3.10.25 (including) | 3.10.25 (including) |
| Android-msm | Codeaurora | 3.10.26 (including) | 3.10.26 (including) |
| Android-msm | Codeaurora | 3.10.27 (including) | 3.10.27 (including) |
| Android-msm | Codeaurora | 3.10.28 (including) | 3.10.28 (including) |
| Android-msm | Codeaurora | 3.10.29 (including) | 3.10.29 (including) |
| Android-msm | Codeaurora | 3.10.30 (including) | 3.10.30 (including) |
| Android-msm | Codeaurora | 3.10.31 (including) | 3.10.31 (including) |
| Android-msm | Codeaurora | 3.10.32 (including) | 3.10.32 (including) |
| Android-msm | Codeaurora | 3.10.33 (including) | 3.10.33 (including) |
| Android-msm | Codeaurora | 3.10.35 (including) | 3.10.35 (including) |
| Android-msm | Codeaurora | 3.10.36 (including) | 3.10.36 (including) |
| Android-msm | Codeaurora | 3.10.37 (including) | 3.10.37 (including) |
| Android-msm | Codeaurora | 3.10.38 (including) | 3.10.38 (including) |
| Android-msm | Codeaurora | 3.10.39 (including) | 3.10.39 (including) |
| Android-msm | Codeaurora | 3.10.40 (including) | 3.10.40 (including) |
| Android-msm | Codeaurora | 3.10.41 (including) | 3.10.41 (including) |
| Android-msm | Codeaurora | 3.10.42 (including) | 3.10.42 (including) |
| Android-msm | Codeaurora | 3.10.43 (including) | 3.10.43 (including) |
| Android-msm | Codeaurora | 3.10.44 (including) | 3.10.44 (including) |
| Android-msm | Codeaurora | 3.10.45 (including) | 3.10.45 (including) |
| Android-msm | Codeaurora | 3.10.46 (including) | 3.10.46 (including) |
| Android-msm | Codeaurora | 3.10.47 (including) | 3.10.47 (including) |
| Android-msm | Codeaurora | 3.10.48 (including) | 3.10.48 (including) |
| Android-msm | Codeaurora | 3.10.49 (including) | 3.10.49 (including) |
| Android-msm | Codeaurora | 3.10.50 (including) | 3.10.50 (including) |
| Android-msm | Codeaurora | 3.10.51 (including) | 3.10.51 (including) |
| Android-msm | Codeaurora | 3.10.52 (including) | 3.10.52 (including) |
| Android-msm | Codeaurora | 3.10.53 (including) | 3.10.53 (including) |
| Android-msm | Codeaurora | 3.12.3 (including) | 3.12.3 (including) |
| Android-msm | Codeaurora | 3.12.4 (including) | 3.12.4 (including) |
| Android-msm | Codeaurora | 3.12.5 (including) | 3.12.5 (including) |
| Android-msm | Codeaurora | 3.12.6 (including) | 3.12.6 (including) |
| Android-msm | Codeaurora | 3.12.7 (including) | 3.12.7 (including) |
| Android-msm | Codeaurora | 3.12.8 (including) | 3.12.8 (including) |
| Android-msm | Codeaurora | 3.12.9 (including) | 3.12.9 (including) |
| Android-msm | Codeaurora | 3.12.10 (including) | 3.12.10 (including) |
| Android-msm | Codeaurora | 3.12.11 (including) | 3.12.11 (including) |
| Android-msm | Codeaurora | 3.12.12 (including) | 3.12.12 (including) |
| Android-msm | Codeaurora | 3.12.13 (including) | 3.12.13 (including) |
| Android-msm | Codeaurora | 3.12.14 (including) | 3.12.14 (including) |
| Android-msm | Codeaurora | 3.12.15 (including) | 3.12.15 (including) |
| Android-msm | Codeaurora | 3.12.16 (including) | 3.12.16 (including) |
| Android-msm | Codeaurora | 3.12.17 (including) | 3.12.17 (including) |
| Android-msm | Codeaurora | 3.12.18 (including) | 3.12.18 (including) |
| Android-msm | Codeaurora | 3.12.19 (including) | 3.12.19 (including) |
| Android-msm | Codeaurora | 3.12.20 (including) | 3.12.20 (including) |
| Android-msm | Codeaurora | 3.12.21 (including) | 3.12.21 (including) |
| Android-msm | Codeaurora | 3.12.22 (including) | 3.12.22 (including) |
| Android-msm | Codeaurora | 3.12.23 (including) | 3.12.23 (including) |
| Android-msm | Codeaurora | 3.12.24 (including) | 3.12.24 (including) |
| Android-msm | Codeaurora | 3.12.25 (including) | 3.12.25 (including) |
| Android-msm | Codeaurora | 3.12.26 (including) | 3.12.26 (including) |
| Android-msm | Codeaurora | 3.13 (including) | 3.13 (including) |
| Android-msm | Codeaurora | 3.13-rc1 (including) | 3.13-rc1 (including) |
| Android-msm | Codeaurora | 3.13-rc2 (including) | 3.13-rc2 (including) |
| Android-msm | Codeaurora | 3.13-rc3 (including) | 3.13-rc3 (including) |
| Android-msm | Codeaurora | 3.13-rc4 (including) | 3.13-rc4 (including) |
| Android-msm | Codeaurora | 3.13-rc5 (including) | 3.13-rc5 (including) |
| Android-msm | Codeaurora | 3.13-rc6 (including) | 3.13-rc6 (including) |
| Android-msm | Codeaurora | 3.13-rc7 (including) | 3.13-rc7 (including) |
| Android-msm | Codeaurora | 3.13-rc8 (including) | 3.13-rc8 (including) |
| Android-msm | Codeaurora | 3.13.1 (including) | 3.13.1 (including) |
| Android-msm | Codeaurora | 3.13.2 (including) | 3.13.2 (including) |
| Android-msm | Codeaurora | 3.13.3 (including) | 3.13.3 (including) |
| Android-msm | Codeaurora | 3.13.4 (including) | 3.13.4 (including) |
| Android-msm | Codeaurora | 3.13.5 (including) | 3.13.5 (including) |
| Android-msm | Codeaurora | 3.13.6 (including) | 3.13.6 (including) |
| Android-msm | Codeaurora | 3.13.7 (including) | 3.13.7 (including) |
| Android-msm | Codeaurora | 3.13.8 (including) | 3.13.8 (including) |
| Android-msm | Codeaurora | 3.13.9 (including) | 3.13.9 (including) |
| Android-msm | Codeaurora | 3.13.10 (including) | 3.13.10 (including) |
| Android-msm | Codeaurora | 3.13.11 (including) | 3.13.11 (including) |
| Android-msm | Codeaurora | 3.14 (including) | 3.14 (including) |
| Android-msm | Codeaurora | 3.14-rc1 (including) | 3.14-rc1 (including) |
| Android-msm | Codeaurora | 3.14-rc2 (including) | 3.14-rc2 (including) |
| Android-msm | Codeaurora | 3.14-rc3 (including) | 3.14-rc3 (including) |
| Android-msm | Codeaurora | 3.14-rc4 (including) | 3.14-rc4 (including) |
| Android-msm | Codeaurora | 3.14-rc5 (including) | 3.14-rc5 (including) |
| Android-msm | Codeaurora | 3.14-rc6 (including) | 3.14-rc6 (including) |
| Android-msm | Codeaurora | 3.14-rc7 (including) | 3.14-rc7 (including) |
| Android-msm | Codeaurora | 3.14-rc8 (including) | 3.14-rc8 (including) |
| Android-msm | Codeaurora | 3.14.1 (including) | 3.14.1 (including) |
| Android-msm | Codeaurora | 3.14.2 (including) | 3.14.2 (including) |
| Android-msm | Codeaurora | 3.14.3 (including) | 3.14.3 (including) |
| Android-msm | Codeaurora | 3.14.4 (including) | 3.14.4 (including) |
| Android-msm | Codeaurora | 3.14.5 (including) | 3.14.5 (including) |
| Android-msm | Codeaurora | 3.14.6 (including) | 3.14.6 (including) |
| Android-msm | Codeaurora | 3.14.7 (including) | 3.14.7 (including) |
| Android-msm | Codeaurora | 3.14.8 (including) | 3.14.8 (including) |
| Android-msm | Codeaurora | 3.14.9 (including) | 3.14.9 (including) |
| Android-msm | Codeaurora | 3.14.10 (including) | 3.14.10 (including) |
| Android-msm | Codeaurora | 3.14.11 (including) | 3.14.11 (including) |
| Android-msm | Codeaurora | 3.14.12 (including) | 3.14.12 (including) |
| Android-msm | Codeaurora | 3.14.13 (including) | 3.14.13 (including) |
| Android-msm | Codeaurora | 3.14.14 (including) | 3.14.14 (including) |
| Android-msm | Codeaurora | 3.14.15 (including) | 3.14.15 (including) |
| Android-msm | Codeaurora | 3.14.16 (including) | 3.14.16 (including) |
| Android-msm | Codeaurora | 3.15 (including) | 3.15 (including) |
| Android-msm | Codeaurora | 3.15-rc1 (including) | 3.15-rc1 (including) |
| Android-msm | Codeaurora | 3.15-rc2 (including) | 3.15-rc2 (including) |
| Android-msm | Codeaurora | 3.15-rc3 (including) | 3.15-rc3 (including) |
| Android-msm | Codeaurora | 3.15-rc4 (including) | 3.15-rc4 (including) |
| Android-msm | Codeaurora | 3.15-rc5 (including) | 3.15-rc5 (including) |
| Android-msm | Codeaurora | 3.15-rc6 (including) | 3.15-rc6 (including) |
| Android-msm | Codeaurora | 3.15-rc7 (including) | 3.15-rc7 (including) |
| Android-msm | Codeaurora | 3.15-rc8 (including) | 3.15-rc8 (including) |
| Android-msm | Codeaurora | 3.15.1 (including) | 3.15.1 (including) |
| Android-msm | Codeaurora | 3.15.2 (including) | 3.15.2 (including) |
| Android-msm | Codeaurora | 3.15.3 (including) | 3.15.3 (including) |
| Android-msm | Codeaurora | 3.15.4 (including) | 3.15.4 (including) |
| Android-msm | Codeaurora | 3.15.5 (including) | 3.15.5 (including) |
| Android-msm | Codeaurora | 3.15.6 (including) | 3.15.6 (including) |
| Android-msm | Codeaurora | 3.15.7 (including) | 3.15.7 (including) |
| Android-msm | Codeaurora | 3.15.8 (including) | 3.15.8 (including) |
| Android-msm | Codeaurora | 3.15.9 (including) | 3.15.9 (including) |
| Android-msm | Codeaurora | 3.15.10 (including) | 3.15.10 (including) |
| Android-msm | Codeaurora | 3.16 (including) | 3.16 (including) |
| Android-msm | Codeaurora | 3.16-rc1 (including) | 3.16-rc1 (including) |
| Android-msm | Codeaurora | 3.16-rc2 (including) | 3.16-rc2 (including) |
| Android-msm | Codeaurora | 3.16-rc3 (including) | 3.16-rc3 (including) |
| Android-msm | Codeaurora | 3.16-rc4 (including) | 3.16-rc4 (including) |
| Android-msm | Codeaurora | 3.16-rc5 (including) | 3.16-rc5 (including) |
| Android-msm | Codeaurora | 3.16-rc6 (including) | 3.16-rc6 (including) |
| Android-msm | Codeaurora | 3.16-rc7 (including) | 3.16-rc7 (including) |
| Android-msm | Codeaurora | 3.16.1 (including) | 3.16.1 (including) |
| Android-msm | Codeaurora | 3.17-rc1 (including) | 3.17-rc1 (including) |
| Linux-flo | Ubuntu | trusty | * |
| Linux-fsl-imx51 | Ubuntu | lucid | * |
| Linux-goldfish | Ubuntu | trusty | * |
| Linux-grouper | Ubuntu | trusty | * |
| Linux-grouper | Ubuntu | utopic | * |
| Linux-linaro-omap | Ubuntu | precise | * |
| Linux-linaro-shared | Ubuntu | precise | * |
| Linux-linaro-vexpress | Ubuntu | precise | * |
| Linux-maguro | Ubuntu | trusty | * |
| Linux-mako | Ubuntu | trusty | * |
| Linux-manta | Ubuntu | trusty | * |
| Linux-mvl-dove | Ubuntu | lucid | * |
| Linux-qcm-msm | Ubuntu | lucid | * |
| Linux-qcm-msm | Ubuntu | precise | * |