The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary file via an attack on the sensor-settings file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Android-msm | Codeaurora | 3.2.54 (including) | 3.2.54 (including) |
| Android-msm | Codeaurora | 3.2.55 (including) | 3.2.55 (including) |
| Android-msm | Codeaurora | 3.2.56 (including) | 3.2.56 (including) |
| Android-msm | Codeaurora | 3.2.57 (including) | 3.2.57 (including) |
| Android-msm | Codeaurora | 3.2.58 (including) | 3.2.58 (including) |
| Android-msm | Codeaurora | 3.2.59 (including) | 3.2.59 (including) |
| Android-msm | Codeaurora | 3.2.60 (including) | 3.2.60 (including) |
| Android-msm | Codeaurora | 3.2.61 (including) | 3.2.61 (including) |
| Android-msm | Codeaurora | 3.2.62 (including) | 3.2.62 (including) |
| Android-msm | Codeaurora | 3.4.72 (including) | 3.4.72 (including) |
| Android-msm | Codeaurora | 3.4.73 (including) | 3.4.73 (including) |
| Android-msm | Codeaurora | 3.4.74 (including) | 3.4.74 (including) |
| Android-msm | Codeaurora | 3.4.75 (including) | 3.4.75 (including) |
| Android-msm | Codeaurora | 3.4.76 (including) | 3.4.76 (including) |
| Android-msm | Codeaurora | 3.4.77 (including) | 3.4.77 (including) |
| Android-msm | Codeaurora | 3.4.78 (including) | 3.4.78 (including) |
| Android-msm | Codeaurora | 3.4.79 (including) | 3.4.79 (including) |
| Android-msm | Codeaurora | 3.4.80 (including) | 3.4.80 (including) |
| Android-msm | Codeaurora | 3.4.81 (including) | 3.4.81 (including) |
| Android-msm | Codeaurora | 3.4.82 (including) | 3.4.82 (including) |
| Android-msm | Codeaurora | 3.4.83 (including) | 3.4.83 (including) |
| Android-msm | Codeaurora | 3.4.84 (including) | 3.4.84 (including) |
| Android-msm | Codeaurora | 3.4.85 (including) | 3.4.85 (including) |
| Android-msm | Codeaurora | 3.4.86 (including) | 3.4.86 (including) |
| Android-msm | Codeaurora | 3.4.87 (including) | 3.4.87 (including) |
| Android-msm | Codeaurora | 3.4.88 (including) | 3.4.88 (including) |
| Android-msm | Codeaurora | 3.4.89 (including) | 3.4.89 (including) |
| Android-msm | Codeaurora | 3.4.90 (including) | 3.4.90 (including) |
| Android-msm | Codeaurora | 3.4.91 (including) | 3.4.91 (including) |
| Android-msm | Codeaurora | 3.4.92 (including) | 3.4.92 (including) |
| Android-msm | Codeaurora | 3.4.93 (including) | 3.4.93 (including) |
| Android-msm | Codeaurora | 3.4.94 (including) | 3.4.94 (including) |
| Android-msm | Codeaurora | 3.4.95 (including) | 3.4.95 (including) |
| Android-msm | Codeaurora | 3.4.96 (including) | 3.4.96 (including) |
| Android-msm | Codeaurora | 3.4.97 (including) | 3.4.97 (including) |
| Android-msm | Codeaurora | 3.4.98 (including) | 3.4.98 (including) |
| Android-msm | Codeaurora | 3.4.99 (including) | 3.4.99 (including) |
| Android-msm | Codeaurora | 3.4.100 (including) | 3.4.100 (including) |
| Android-msm | Codeaurora | 3.4.101 (including) | 3.4.101 (including) |
| Android-msm | Codeaurora | 3.4.102 (including) | 3.4.102 (including) |
| Android-msm | Codeaurora | 3.4.103 (including) | 3.4.103 (including) |
| Android-msm | Codeaurora | 3.10 (including) | 3.10 (including) |
| Android-msm | Codeaurora | 3.10.22 (including) | 3.10.22 (including) |
| Android-msm | Codeaurora | 3.10.23 (including) | 3.10.23 (including) |
| Android-msm | Codeaurora | 3.10.24 (including) | 3.10.24 (including) |
| Android-msm | Codeaurora | 3.10.25 (including) | 3.10.25 (including) |
| Android-msm | Codeaurora | 3.10.26 (including) | 3.10.26 (including) |
| Android-msm | Codeaurora | 3.10.27 (including) | 3.10.27 (including) |
| Android-msm | Codeaurora | 3.10.28 (including) | 3.10.28 (including) |
| Android-msm | Codeaurora | 3.10.29 (including) | 3.10.29 (including) |
| Android-msm | Codeaurora | 3.10.30 (including) | 3.10.30 (including) |
| Android-msm | Codeaurora | 3.10.31 (including) | 3.10.31 (including) |
| Android-msm | Codeaurora | 3.10.32 (including) | 3.10.32 (including) |
| Android-msm | Codeaurora | 3.10.33 (including) | 3.10.33 (including) |
| Android-msm | Codeaurora | 3.10.35 (including) | 3.10.35 (including) |
| Android-msm | Codeaurora | 3.10.36 (including) | 3.10.36 (including) |
| Android-msm | Codeaurora | 3.10.37 (including) | 3.10.37 (including) |
| Android-msm | Codeaurora | 3.10.38 (including) | 3.10.38 (including) |
| Android-msm | Codeaurora | 3.10.39 (including) | 3.10.39 (including) |
| Android-msm | Codeaurora | 3.10.40 (including) | 3.10.40 (including) |
| Android-msm | Codeaurora | 3.10.41 (including) | 3.10.41 (including) |
| Android-msm | Codeaurora | 3.10.42 (including) | 3.10.42 (including) |
| Android-msm | Codeaurora | 3.10.43 (including) | 3.10.43 (including) |
| Android-msm | Codeaurora | 3.10.44 (including) | 3.10.44 (including) |
| Android-msm | Codeaurora | 3.10.45 (including) | 3.10.45 (including) |
| Android-msm | Codeaurora | 3.10.46 (including) | 3.10.46 (including) |
| Android-msm | Codeaurora | 3.10.47 (including) | 3.10.47 (including) |
| Android-msm | Codeaurora | 3.10.48 (including) | 3.10.48 (including) |
| Android-msm | Codeaurora | 3.10.49 (including) | 3.10.49 (including) |
| Android-msm | Codeaurora | 3.10.50 (including) | 3.10.50 (including) |
| Android-msm | Codeaurora | 3.10.51 (including) | 3.10.51 (including) |
| Android-msm | Codeaurora | 3.10.52 (including) | 3.10.52 (including) |
| Android-msm | Codeaurora | 3.10.53 (including) | 3.10.53 (including) |
| Android-msm | Codeaurora | 3.12.3 (including) | 3.12.3 (including) |
| Android-msm | Codeaurora | 3.12.4 (including) | 3.12.4 (including) |
| Android-msm | Codeaurora | 3.12.5 (including) | 3.12.5 (including) |
| Android-msm | Codeaurora | 3.12.6 (including) | 3.12.6 (including) |
| Android-msm | Codeaurora | 3.12.7 (including) | 3.12.7 (including) |
| Android-msm | Codeaurora | 3.12.8 (including) | 3.12.8 (including) |
| Android-msm | Codeaurora | 3.12.9 (including) | 3.12.9 (including) |
| Android-msm | Codeaurora | 3.12.10 (including) | 3.12.10 (including) |
| Android-msm | Codeaurora | 3.12.11 (including) | 3.12.11 (including) |
| Android-msm | Codeaurora | 3.12.12 (including) | 3.12.12 (including) |
| Android-msm | Codeaurora | 3.12.13 (including) | 3.12.13 (including) |
| Android-msm | Codeaurora | 3.12.14 (including) | 3.12.14 (including) |
| Android-msm | Codeaurora | 3.12.15 (including) | 3.12.15 (including) |
| Android-msm | Codeaurora | 3.12.16 (including) | 3.12.16 (including) |
| Android-msm | Codeaurora | 3.12.17 (including) | 3.12.17 (including) |
| Android-msm | Codeaurora | 3.12.18 (including) | 3.12.18 (including) |
| Android-msm | Codeaurora | 3.12.19 (including) | 3.12.19 (including) |
| Android-msm | Codeaurora | 3.12.20 (including) | 3.12.20 (including) |
| Android-msm | Codeaurora | 3.12.21 (including) | 3.12.21 (including) |
| Android-msm | Codeaurora | 3.12.22 (including) | 3.12.22 (including) |
| Android-msm | Codeaurora | 3.12.23 (including) | 3.12.23 (including) |
| Android-msm | Codeaurora | 3.12.24 (including) | 3.12.24 (including) |
| Android-msm | Codeaurora | 3.12.25 (including) | 3.12.25 (including) |
| Android-msm | Codeaurora | 3.12.26 (including) | 3.12.26 (including) |
| Android-msm | Codeaurora | 3.13 (including) | 3.13 (including) |
| Android-msm | Codeaurora | 3.13-rc1 (including) | 3.13-rc1 (including) |
| Android-msm | Codeaurora | 3.13-rc2 (including) | 3.13-rc2 (including) |
| Android-msm | Codeaurora | 3.13-rc3 (including) | 3.13-rc3 (including) |
| Android-msm | Codeaurora | 3.13-rc4 (including) | 3.13-rc4 (including) |
| Android-msm | Codeaurora | 3.13-rc5 (including) | 3.13-rc5 (including) |
| Android-msm | Codeaurora | 3.13-rc6 (including) | 3.13-rc6 (including) |
| Android-msm | Codeaurora | 3.13-rc7 (including) | 3.13-rc7 (including) |
| Android-msm | Codeaurora | 3.13-rc8 (including) | 3.13-rc8 (including) |
| Android-msm | Codeaurora | 3.13.1 (including) | 3.13.1 (including) |
| Android-msm | Codeaurora | 3.13.2 (including) | 3.13.2 (including) |
| Android-msm | Codeaurora | 3.13.3 (including) | 3.13.3 (including) |
| Android-msm | Codeaurora | 3.13.4 (including) | 3.13.4 (including) |
| Android-msm | Codeaurora | 3.13.5 (including) | 3.13.5 (including) |
| Android-msm | Codeaurora | 3.13.6 (including) | 3.13.6 (including) |
| Android-msm | Codeaurora | 3.13.7 (including) | 3.13.7 (including) |
| Android-msm | Codeaurora | 3.13.8 (including) | 3.13.8 (including) |
| Android-msm | Codeaurora | 3.13.9 (including) | 3.13.9 (including) |
| Android-msm | Codeaurora | 3.13.10 (including) | 3.13.10 (including) |
| Android-msm | Codeaurora | 3.13.11 (including) | 3.13.11 (including) |
| Android-msm | Codeaurora | 3.14 (including) | 3.14 (including) |
| Android-msm | Codeaurora | 3.14-rc1 (including) | 3.14-rc1 (including) |
| Android-msm | Codeaurora | 3.14-rc2 (including) | 3.14-rc2 (including) |
| Android-msm | Codeaurora | 3.14-rc3 (including) | 3.14-rc3 (including) |
| Android-msm | Codeaurora | 3.14-rc4 (including) | 3.14-rc4 (including) |
| Android-msm | Codeaurora | 3.14-rc5 (including) | 3.14-rc5 (including) |
| Android-msm | Codeaurora | 3.14-rc6 (including) | 3.14-rc6 (including) |
| Android-msm | Codeaurora | 3.14-rc7 (including) | 3.14-rc7 (including) |
| Android-msm | Codeaurora | 3.14-rc8 (including) | 3.14-rc8 (including) |
| Android-msm | Codeaurora | 3.14.1 (including) | 3.14.1 (including) |
| Android-msm | Codeaurora | 3.14.2 (including) | 3.14.2 (including) |
| Android-msm | Codeaurora | 3.14.3 (including) | 3.14.3 (including) |
| Android-msm | Codeaurora | 3.14.4 (including) | 3.14.4 (including) |
| Android-msm | Codeaurora | 3.14.5 (including) | 3.14.5 (including) |
| Android-msm | Codeaurora | 3.14.6 (including) | 3.14.6 (including) |
| Android-msm | Codeaurora | 3.14.7 (including) | 3.14.7 (including) |
| Android-msm | Codeaurora | 3.14.8 (including) | 3.14.8 (including) |
| Android-msm | Codeaurora | 3.14.9 (including) | 3.14.9 (including) |
| Android-msm | Codeaurora | 3.14.10 (including) | 3.14.10 (including) |
| Android-msm | Codeaurora | 3.14.11 (including) | 3.14.11 (including) |
| Android-msm | Codeaurora | 3.14.12 (including) | 3.14.12 (including) |
| Android-msm | Codeaurora | 3.14.13 (including) | 3.14.13 (including) |
| Android-msm | Codeaurora | 3.14.14 (including) | 3.14.14 (including) |
| Android-msm | Codeaurora | 3.14.15 (including) | 3.14.15 (including) |
| Android-msm | Codeaurora | 3.14.16 (including) | 3.14.16 (including) |
| Android-msm | Codeaurora | 3.15 (including) | 3.15 (including) |
| Android-msm | Codeaurora | 3.15-rc1 (including) | 3.15-rc1 (including) |
| Android-msm | Codeaurora | 3.15-rc2 (including) | 3.15-rc2 (including) |
| Android-msm | Codeaurora | 3.15-rc3 (including) | 3.15-rc3 (including) |
| Android-msm | Codeaurora | 3.15-rc4 (including) | 3.15-rc4 (including) |
| Android-msm | Codeaurora | 3.15-rc5 (including) | 3.15-rc5 (including) |
| Android-msm | Codeaurora | 3.15-rc6 (including) | 3.15-rc6 (including) |
| Android-msm | Codeaurora | 3.15-rc7 (including) | 3.15-rc7 (including) |
| Android-msm | Codeaurora | 3.15-rc8 (including) | 3.15-rc8 (including) |
| Android-msm | Codeaurora | 3.15.1 (including) | 3.15.1 (including) |
| Android-msm | Codeaurora | 3.15.2 (including) | 3.15.2 (including) |
| Android-msm | Codeaurora | 3.15.3 (including) | 3.15.3 (including) |
| Android-msm | Codeaurora | 3.15.4 (including) | 3.15.4 (including) |
| Android-msm | Codeaurora | 3.15.5 (including) | 3.15.5 (including) |
| Android-msm | Codeaurora | 3.15.6 (including) | 3.15.6 (including) |
| Android-msm | Codeaurora | 3.15.7 (including) | 3.15.7 (including) |
| Android-msm | Codeaurora | 3.15.8 (including) | 3.15.8 (including) |
| Android-msm | Codeaurora | 3.15.9 (including) | 3.15.9 (including) |
| Android-msm | Codeaurora | 3.15.10 (including) | 3.15.10 (including) |
| Android-msm | Codeaurora | 3.16 (including) | 3.16 (including) |
| Android-msm | Codeaurora | 3.16-rc1 (including) | 3.16-rc1 (including) |
| Android-msm | Codeaurora | 3.16-rc2 (including) | 3.16-rc2 (including) |
| Android-msm | Codeaurora | 3.16-rc3 (including) | 3.16-rc3 (including) |
| Android-msm | Codeaurora | 3.16-rc4 (including) | 3.16-rc4 (including) |
| Android-msm | Codeaurora | 3.16-rc5 (including) | 3.16-rc5 (including) |
| Android-msm | Codeaurora | 3.16-rc6 (including) | 3.16-rc6 (including) |
| Android-msm | Codeaurora | 3.16-rc7 (including) | 3.16-rc7 (including) |
| Android-msm | Codeaurora | 3.16.1 (including) | 3.16.1 (including) |
| Android-msm | Codeaurora | 3.17-rc1 (including) | 3.17-rc1 (including) |