An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33042690.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Android | 7.0 (including) | 7.0 (including) | |
| Android | 7.1.0 (including) | 7.1.0 (including) | |
| Android | 7.1.1 (including) | 7.1.1 (including) | |
| Android | Ubuntu | esm-apps/xenial | * |
| Android | Ubuntu | trusty | * |
| Android | Ubuntu | vivid/stable-phone-overlay | * |
| Android | Ubuntu | xenial | * |
| Android | Ubuntu | yakkety | * |
| Android | Ubuntu | zesty | * |
Potential Mitigations
Related Attack Patterns
References
- http://www.securityfocus.com/bid/96056
- http://www.securitytracker.com/id/1037798
- https://source.android.com/security/bulletin/2017-02-01.html
- https://www.exploit-db.com/exploits/41354/
- http://www.securityfocus.com/bid/96056
- http://www.securitytracker.com/id/1037798
- https://source.android.com/security/bulletin/2017-02-01.html
- https://www.exploit-db.com/exploits/41354/