Android Security Bulletin—September 2016

ded

Published September 06, 2016 | Updated September 12, 2016

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware images have also been released to the Google Developer site. Security Patch Levels of September 06, 2016 or later address these issues. Refer to the documentation to learn how to check the security patch level. Supported Nexus devices will receive a single OTA update with the September 06, 2016 security patch level.

Partners were notified about the issues described in the bulletin on August 05, 2016 or earlier. Where applicable, source code patches for these issues have been released to the Android Open Source Project (AOSP) repository. This bulletin also includes links to patches outside of AOSP.

The most severe of these issues is a Critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.

We have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the Android and Google service mitigations section for details on the Android security platform protections and service protections such as SafetyNet, which improve the security of the Android platform.

We encourage all customers to accept these updates to their devices.

Announcements

  • This bulletin has three security patch level strings to provide Android partners with the flexibility to move more quickly to fix a subset of vulnerabilities that are similar across all Android devices. See Common questions and answers for additional information:
    • 2016-09-01: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-09-01 (and all previous security patch level strings) are addressed.
    • 2016-09-05: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-09-01 and 2016-09-05 (and all previous security patch level strings) are addressed.
    • 2016-09-06: Complete security patch level string, which addresses issues that were discovered after partners were notified of most issues in this bulletin. This security patch level string indicates that all issues associated with 2016-09-01, 2016-09-05, and 2016-09-06 (and all previous security patch level strings) are addressed.
  • Supported Nexus devices will receive a single OTA update with the September 06, 2016 security patch level.

Android and Google service mitigations

This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.

  • Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
  • The Android Security team actively monitors for abuse with Verify Apps and SafetyNet, which are designed to warn users about Potentially Harmful Applications. Verify Apps is enabled by default on devices with Google Mobile Services, and is especially important for users who install applications from outside of Google Play. Device rooting tools are prohibited within Google Play, but Verify Apps warns users when they attempt to install a detected rooting application—no matter where it comes from. Additionally, Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove the detected application.
  • As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as Mediaserver.

Acknowledgements

We would like to thank these researchers for their contributions:

  • Cory Pruce of Carnegie Mellon University: CVE-2016-3897
  • Gengjia Chen (@chengjia4574) and pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd.: CVE-2016-3869, CVE-2016-3865, CVE-2016-3866, CVE-2016-3867
  • Hao Qin of Security Research Lab, Cheetah Mobile: CVE-2016-3863
  • Jann Horn of Google Project Zero: CVE-2016-3885
  • Jianqiang Zhao (@jianqiangzhao) and pjf of IceSword Lab, Qihoo 360: CVE-2016-3858
  • Joshua Drake (@jduck): CVE-2016-3861
  • Madhu Priya Murugan of CISPA, Saarland University: CVE-2016-3896
  • Makoto Onuki of Google: CVE-2016-3876
  • Mark Brand of Google Project Zero: CVE-2016-3861
  • Max Spector of Android Security: CVE-2016-3888
  • Max Spector and Quan To of Android Security: CVE-2016-3889
  • Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3895
  • Nathan Crandall (@natecray) of Tesla Motors Product Security Team: Discovery of additional issues related to CVE-2016-2446
  • Oleksiy Vyalov of Google: CVE-2016-3890
  • Oliver Chang of Google Chrome Security Team: CVE-2016-3880
  • Peng Xiao, Chengming Yang, Ning You, Chao Yang, and Yang song, of Alibaba Mobile Security Group: CVE-2016-3859
  • Ronald L. Loor Vargas (@loor_rlv) of TEAM Lv51: CVE-2016-3886
  • Sagi Kedmi, IBM Security X-Force Researcher: CVE-2016-3873
  • Scott Bauer (@ScottyBauer1): CVE-2016-3893, CVE-2016-3868, CVE-2016-3867
  • Seven Shen (@lingtongshen) of TrendMicro: CVE-2016-3894
  • Tim Strazzere (@timstrazz) of SentinelOne / RedNaga: CVE-2016-3862
  • trotmaster (@trotmaster99): CVE-2016-3883
  • Victor Chang of Google: CVE-2016-3887
  • Vignesh Venkatasubramanian of Google: CVE-2016-3881
  • Weichao Sun (@sunblate) of Alibaba Inc: CVE-2016-3878
  • Wenke Dou, Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3870, CVE-2016-3871, CVE-2016-3872
  • Wish Wu (吴潍浠) (@wish_wu) of Trend Micro Inc.: CVE-2016-3892
  • Xingyu He (何星宇) (@Spid3r_) of Alibaba Inc: CVE-2016-3879
  • Yacong Gu of TCA Lab, Institute of Software, Chinese Academy of Sciences: CVE-2016-3884
  • Yuru Shao of University of Michigan Ann Arbor: CVE-2016-3898

2016-09-01 security patch level—Security vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-09-01 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.

Remote code execution vulnerability in LibUtils

A remote code execution vulnerability in LibUtils could enable an attacker using a specially crafted file to execute arbitrary code in the context of a privileged process. This issue is rated as Critical due to the possibility of remote code execution in applications that use this library.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3861 A-29250543 [2] [3] [4] Critical All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 9, 2016

Remote code execution vulnerability in Mediaserver

A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3862 A-29270469 Critical All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 Jun 10, 2016

Remote code execution vulnerability in MediaMuxer

A remote code execution vulnerability in MediaMuxer could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses MediaMuxer.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3863 A-29161888 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 6, 2016

Elevation of privilege vulnerability in Mediaserver

An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3870 A-29421804 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 15, 2016
CVE-2016-3871 A-29422022 [2] [3] High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 15, 2016
CVE-2016-3872 A-29421675 [2] High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 15, 2016

Elevation of privilege vulnerability in device boot

An elevation of privilege during the boot sequence could enable a local malicious attacker to boot into safe mode even though it's disabled. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3875 A-26251884 High None* 6.0, 6.0.1 Google internal

* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.

Elevation of privilege vulnerability in Settings

An elevation of privilege in Settings could enable a local malicious attacker to boot into safe mode even though it's disabled. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3876 A-29900345 High All Nexus 6.0, 6.0.1, 7.0 Google internal

Denial of service vulnerability in Mediaserver

A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3899 A-29421811 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 16, 2016
CVE-2016-3878 A-29493002 High All Nexus* 6.0, 6.0.1 Jun 17, 2016
CVE-2016-3879 A-29770686 High All Nexus* 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 Jun 25, 2016
CVE-2016-3880 A-25747670 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Google internal
CVE-2016-3881 A-30013856 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Google internal

* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.

Elevation of privilege vulnerability in Telephony

An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to send unauthorized premium SMS messages. This issue is rated as Moderate because it could be used to gain elevated capabilities without explicit user permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3883 A-28557603 Moderate All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 May 3, 2016

Elevation of privilege vulnerability in Notification Manager Service

An elevation of privilege vulnerability in the Notification Manager Service could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate because it is a local bypass of user interaction requirements, such as access to functionality that would normally require either user initiation or user permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3884 A-29421441 Moderate All Nexus 6.0, 6.0.1, 7.0 Jun 15, 2016

Elevation of privilege vulnerability in Debuggerd

An elevation of privilege vulnerability in the integrated Android debugger could enable a local malicious application to execute arbitrary code within the context of the Android debugger. This issue is rated as Moderate severity due to the possibility of local arbitrary code execution in a privileged process.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3885 A-29555636 Moderate All Nexus 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 21, 2016

Elevation of privilege vulnerability in System UI Tuner

An elevation of privilege in the System UI Tuner could enable a local malicious user to modify protected settings when a device is locked. This issue is rated as Moderate because it is a local bypass of user permissions.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3886 A-30107438 Moderate All Nexus 7.0 Jun 23, 2016

Elevation of privilege vulnerability in Settings

An elevation of privilege vulnerability in Settings could enable a local malicious application to bypass operating system protections for VPN settings. This issue is rated as Moderate because it could be used to gain access to data that is outside of the application’s permission levels.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3887 A-29899712 Moderate All Nexus 7.0 Google internal

Elevation of privilege vulnerability in SMS

An elevation of privilege vulnerability in SMS could enable a local attacker to send premium SMS messages prior to the device being provisioned. This is rated as Moderate due to the possibility of bypassing Factory Reset Protection, which should prevent the device from being used before it is set up.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3888 A-29420123 Moderate All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Google internal

Elevation of privilege vulnerability in Settings

An elevation of privilege vulnerability in Settings could enable a local attacker to bypass the Factory Reset Protection and gain access to the device. This is rated as Moderate due to the possibility of bypassing Factory Reset Protection, which could lead to successfully resetting the device and erasing all its data.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3889 A-29194585 [2] Moderate All Nexus 6.0, 6.0.1, 7.0 Google internal

Elevation of privilege vulnerability in Java Debug Wire Protocol

An elevation of privilege vulnerability in the Java Debug Wire Protocol could enable a local malicious application to execute arbitrary code within the context of an elevated system application. This issue is rated as Moderate because it requires an uncommon device configuration.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3890 A-28347842 [2] Moderate None* 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 Google internal

* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.

Information disclosure vulnerability in Mediaserver

An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3895 A-29983260 Moderate All Nexus 6.0, 6.0.1, 7.0 Jul 4, 2016

Information disclosure vulnerability in AOSP Mail

An information disclosure vulnerability in AOSP Mail could enable a local malicious application to gain access to user’s private information. This issue is rated as Moderate because it could be used to improperly access data without permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3896 A-29767043 Moderate None* 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 Jul 24, 2016

* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.

Information disclosure vulnerability in Wi-Fi

An information disclosure vulnerability in the Wi-Fi configuration could allow an application to access sensitive information. This issue is rated as Moderate because it could be used to access data without permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3897 A-25624963 [2] Moderate None* 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 Nov 5, 2015

* Supported Nexus devices on Android 7.0 that have installed all available updates are not affected by this vulnerability.

Denial of service vulnerability in Telephony

A denial of service vulnerability in the Telephony component could enable a local malicious application to prevent 911 TTY calls from a locked screen. This issue is rated as Moderate due to the possibility of a denial of service on a critical function.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3898 A-29832693 Moderate All Nexus 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 28, 2016

2016-09-05 security patch level—Vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-09-05 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.

Elevation of privilege vulnerability in kernel security subsystem

An elevation of privilege vulnerability in the kernel security subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2014-9529 A-29510361

Upstream kernel

Critical Nexus 5, Nexus 6, Nexus 9, Nexus Player, Android One Jan 6, 2015
CVE-2016-4470 A-29823941

Upstream kernel

Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player June 15, 2016

Elevation of privilege vulnerability in kernel networking subsystem

An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2013-7446 A-29119002

Upstream kernel

Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Nov 18, 2015

Elevation of privilege vulnerability in kernel netfilter subsystem

An elevation of privilege vulnerability in the kernel netfilter subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3134 A-28940694

Upstream kernel

Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Mar 9, 2016

Elevation of privilege vulnerability in kernel USB driver

An elevation of privilege vulnerability in the kernel USB driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3951 A-28744625

Upstream kernel [2]

Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Apr 6, 2016

Elevation of privilege vulnerability in kernel sound subsystem

An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2014-4655 A-29916012

Upstream kernel

High Nexus 5, Nexus 6, Nexus 9, Nexus Player Jun 26, 2014

Elevation of privilege vulnerability in kernel ASN.1 decoder

An elevation of privilege vulnerability in the kernel ASN.1 decoder could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-2053 A-28751627

Upstream kernel

High Nexus 5X, Nexus 6P Jan 25, 2016

Elevation of privilege vulnerability in Qualcomm radio interface layer

An elevation of privilege vulnerability in the Qualcomm radio interface layer could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3864 A-28823714*
QC-CR#913117
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Apr 29, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm subsystem driver

An elevation of privilege vulnerability in the Qualcomm subsystem driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3858 A-28675151
QC-CR#1022641
High Nexus 5X, Nexus 6P May 9, 2016

Elevation of privilege vulnerability in kernel networking driver

An elevation of privilege vulnerability in the kernel networking driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-4805 A-28979703

Upstream kernel

High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9 May 15, 2016

Elevation of privilege vulnerability in Synaptics touchscreen driver

An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3865 A-28799389* High Nexus 5X, Nexus 9 May 16, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm camera driver

An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3859 A-28815326*
QC-CR#1034641
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P May 17, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm sound driver

An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3866 A-28868303*
QC-CR#1032820
High Nexus 5X, Nexus 6, Nexus 6P May 18, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm IPA driver

An elevation of privilege vulnerability in the Qualcomm IPA driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3867 A-28919863*
QC-CR#1037897
High Nexus 5X, Nexus 6P May 21, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm power driver

An elevation of privilege vulnerability in the Qualcomm power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3868 A-28967028*
QC-CR#1032875
High Nexus 5X, Nexus 6P May 25, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Broadcom Wi-Fi driver

An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3869 A-29009982*
B-RB#96070
High Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C May 27, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in kernel eCryptfs filesystem

An elevation of privilege vulnerability in the kernel eCryptfs filesystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-1583 A-29444228
Upstream kernel
High Pixel C Jun 1, 2016

Elevation of privilege vulnerability in NVIDIA kernel

An elevation of privilege vulnerability in the NVIDIA kernel could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High severity because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3873 A-29518457*
N-CVE-2016-3873
High Nexus 9 Jun 20, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm Wi-Fi driver

An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3874 A-29944562
QC-CR#997797 [2]
High Nexus 5X Jul 1, 2016

Denial of service vulnerability in kernel networking subsystem

A denial of service vulnerability in the kernel networking subsystem could enable an attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-1465 A-29506807

Upstream kernel

High Nexus 5, Nexus 6, Nexus 9, Nexus Player, Pixel C, Android One Feb 3, 2015
CVE-2015-5364 A-29507402

Upstream kernel

High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Jun 30, 2015

Denial of service vulnerability in kernel ext4 file system

A denial of service vulnerability in the kernel ext4 file system could enable an attacker to cause a local permanent denial of service, which may require reflashing the operating system to repair the device. This issue is rated as High due to the possibility of local permanent denial of service.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-8839 A-28760453* High Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Apr 4, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in Qualcomm SPMI driver

An information disclosure vulnerability in the Qualcomm SPMI driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3892 A-28760543*
QC-CR#1024197
Moderate Nexus 5, Nexus 5X, Nexus 6, Nexus 6P May 13, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in Qualcomm sound codec

An information disclosure vulnerability in the Qualcomm sound codec could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3893 A-29512527
QC-CR#856400
Moderate Nexus 6P Jun 20, 2016

Information disclosure vulnerability in Qualcomm DMA component

An information disclosure vulnerability in the Qualcomm DMA component could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3894 A-29618014*
QC-CR#1042033
Moderate Nexus 6 Jun 23, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in kernel networking subsystem

An information disclosure vulnerability in the kernel networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-4998 A-29637687
Upstream kernel [2]
Moderate Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Jun 24, 2016

Denial of service vulnerability in kernel networking subsystem

A denial of service vulnerability in the kernel networking subsystem could enable an attacker to block access to Wi-Fi capabilities.This issue is rated as Moderate due to the possibility of a temporary remote denial of service of the Wi-Fi capabilities.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-2922 A-29409847

Upstream kernel

Moderate Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Apr 4, 2015

Vulnerabilities in Qualcomm components

The table below contains security vulnerabilities affecting Qualcomm components, potentially including the bootloader, camera driver, character driver, networking, sound driver, and video driver.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-2469 QC-CR#997025 High None Jun 2016
CVE-2016-2469 QC-CR#997015 Moderate None Jun 2016

2016-09-06 security patch level—Vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-09-06 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.

Elevation of privilege vulnerability in kernel shared memory subsystem

An elevation of privilege vulnerability in the kernel shared memory subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-5340 A-30652312
QC-CR#1008948
Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Jul 26, 2016

Elevation of privilege vulnerability in Qualcomm networking component

An elevation of privilege vulnerability in the Qualcomm networking component could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-2059 A-27045580
QC-CR#974577
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Feb 4, 2016

Common Questions and Answers

This section answers common questions that may occur after reading this bulletin.

1. How do I determine if my device is updated to address these issues?

Security Patch Levels of 2016-09-01 or later address all issues associated with the 2016-09-01 security patch string level. Security Patch Levels of 2016-09-05 or later address all issues associated with the 2016-09-05 security patch string level. Security Patch Levels of 2016-09-06 or later address all issues associated with the 2016-09-06 security patch string level. Refer to the help center for instructions on how to check the security patch level. Device manufacturers that include these updates should set the patch string level to: [ro.build.version.security_patch]:[2016-09-01], [ro.build.version.security_patch]:[2016-09-05], or [ro.build.version.security_patch]:[2016-09-06].

2. Why does this bulletin have three security patch level strings?

This bulletin has three security patch level strings so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level string.

Devices that use the September 6, 2016 security patch level or newer must include all applicable patches in this (and previous) security bulletins. This patch level was created to addresses issues that were discovered after partners were first notified of most issues in this bulletin.

Devices that use September 5, 2016 security patch level must include all issues associated with that security patch level, the September 1, 2016 security patch level and fixes for all issues reported in previous security bulletins. Devices that use the September 5, 2016 security patch level may also include a subset of fixes associated with the September 6, 2016 security patch level.

Devices that use September 1, 2016 security patch level must include all issues associated with that security patch level as well as fixes for all issues reported in previous security bulletins. Devices that use the September 1, 2016 security patch level may also include a subset of fixes associated with the September 5, 2016 and September 6, 2016 security patch levels.

3. How do I determine which Nexus devices are affected by each issue?

In the 2016-09-01, 2016-09-05, and 2016-09-06 security vulnerability details sections, each table has an Updated Nexus devices column that covers the range of affected Nexus devices updated for each issue. This column has a few options:

  • All Nexus devices: If an issue affects all Nexus devices, the table will have “All Nexus” in the Updated Nexus devices column. “All Nexus” encapsulates the following supported devices: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Android One, Nexus Player, and Pixel C.
  • Some Nexus devices: If an issue doesn’t affect all Nexus devices, the affected Nexus devices are listed in the Updated Nexus devices column.
  • No Nexus devices: If no Nexus devices running Android 7.0 are affected by the issue, the table will have “None” in the Updated Nexus devices column.

4. What do the entries in the references column map to?

Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. These prefixes map as follows:

Prefix Reference
A- Android bug ID
QC- Qualcomm reference number
M- MediaTek reference number
N- NVIDIA reference number
B- Broadcom reference number

Revisions

  • September 06, 2016: Bulletin published.
  • September 07, 2016: Bulletin revised to include AOSP links.
  • September 12, 2016: Bulletin revised to update attribution for CVE-2016-3861 and remove CVE-2016-3877.