Exploiting CVE-2016-2060 on Qualcomm Devices[html]
Mandiant’s Red Team recently discovered a widespread vulnerability
affecting Android devices that permits local privilege escalation to
the built-in user “radio”, making it so an attacker can potentially
perform activities such as viewing the victim’s SMS database and phone
history. The vulnerability exists in a software package maintained by
Qualcomm that is available from the Code Aurora Forum. It is published
as CVE-2016-2060 and href="https://www.codeaurora.org/improper-input-validation-tethering-controller-netd-cve-2016-2060-0"
target="_blank">security advisory QCIR-2016-00001-1 on the Code
Aurora Forum. We have provided general details in an FAQ, and a
technical analysis of the vulnerability follows.
FAQ
What is CVE-2016-2060?
CVE-2016-2060 is a lack of input sanitization of the
"interface" parameter of the "netd" daemon, a
daemon that is part of the Android Open Source Project (AOSP). The
vulnerability was introduced when Qualcomm provided new APIs as part
of the "network_manager" system service, and subsequently
the "netd" daemon, that allow additional tethering
capabilities, possibly among other things. Qualcomm had modified the
"netd" daemon.
How many devices are affected?
There is no solid answer. Since many flagship and non-flagship
devices use Qualcomm chips and/or Qualcomm code, it is possible that
hundreds of models are affected across the last five years. To provide
some API numbers, Android Gingerbread (2.3.x) was released in 2011.
This vulnerability was confirmed on devices running Lollipop (5.0),
KitKat (4.4), and Jellybean MR2 (4.3), and the Git commit referenced
in the post is Ice Cream Sandwich MR1 (4.0.3).
How is the issue being addressed?
Qualcomm has addressed the issue by patching the "netd"
daemon. Qualcomm notified their customers (all of the OEMs) in early
March 2016.
