CVE-2016-2420

rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.

Affected Software

Name	Vendor	Start Version	End Version
Android	Google	4.0 (including)	4.0 (including)
Android	Google	4.0.1 (including)	4.0.1 (including)
Android	Google	4.0.2 (including)	4.0.2 (including)
Android	Google	4.0.3 (including)	4.0.3 (including)
Android	Google	4.0.4 (including)	4.0.4 (including)
Android	Google	4.1 (including)	4.1 (including)
Android	Google	4.1.2 (including)	4.1.2 (including)
Android	Google	4.2 (including)	4.2 (including)
Android	Google	4.2.1 (including)	4.2.1 (including)
Android	Google	4.2.2 (including)	4.2.2 (including)
Android	Google	4.3 (including)	4.3 (including)
Android	Google	4.3.1 (including)	4.3.1 (including)
Android	Google	4.4 (including)	4.4 (including)
Android	Google	4.4.1 (including)	4.4.1 (including)
Android	Google	4.4.2 (including)	4.4.2 (including)
Android	Google	4.4.3 (including)	4.4.3 (including)
Android	Google	5.0 (including)	5.0 (including)
Android	Google	5.0.1 (including)	5.0.1 (including)
Android	Google	5.1 (including)	5.1 (including)
Android	Google	5.1.0 (including)	5.1.0 (including)
Android	Google	6.0 (including)	6.0 (including)
Android	Google	6.0.1 (including)	6.0.1 (including)
Android	Ubuntu	esm-apps/xenial	*
Android	Ubuntu	trusty	*
Android	Ubuntu	upstream	*
Android	Ubuntu	vivid/stable-phone-overlay	*
Android	Ubuntu	wily	*
Android	Ubuntu	xenial	*
Android	Ubuntu	yakkety	*
Android	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-2420
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References