CVE Vulnerabilities

CVE-2017-0412

Time-of-check Time-of-use (TOCTOU) Race Condition

Published: Feb 08, 2017 | Modified: Oct 03, 2019
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33039926.

Weakness

The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

Affected Software

Name Vendor Start Version End Version
Android Google 7.0 (including) 7.0 (including)
Android Google 7.1.0 (including) 7.1.0 (including)
Android Google 7.1.1 (including) 7.1.1 (including)
Android Ubuntu esm-apps/xenial *
Android Ubuntu trusty *
Android Ubuntu vivid/stable-phone-overlay *
Android Ubuntu xenial *
Android Ubuntu yakkety *
Android Ubuntu zesty *

Potential Mitigations

References