Published October 03, 2016 | Updated October 04, 2016
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware images have also been released to the Google Developer site. Security Patch Levels of October 05, 2016 or later address these issues. Refer to the documentation to learn how to check the security patch level. Supported Nexus devices will receive a single OTA update with the October 05, 2016 security patch level.
Partners were notified about the issues described in the bulletin on September 06, 2016 or earlier. Where applicable, source code patches for these issues have been released to the Android Open Source Project (AOSP) repository. This bulletin also includes links to patches outside of AOSP.
The most severe of these issues are Critical security vulnerabilities in device-specific code that could enable remote code execution within the context of the kernel, leading to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.
We have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the Android and Google service mitigations section for details on the Android security platform protections and service protections such as SafetyNet, which improve the security of the Android platform.
We encourage all customers to accept these updates to their devices.
Announcements
- This bulletin has two security patch level strings to provide Android
partners with the flexibility to more quickly fix a subset of vulnerabilities
that are similar across all Android devices. See
Common questions and answers for
additional information:
- 2016-10-01: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-10-01 (and all previous security patch level strings) are addressed.
- 2016-10-05: Complete security patch level string. This security patch level string indicates that all issues associated with 2016-10-01 and 2016-10-05 (and all previous security patch level strings) are addressed.
- Supported Nexus devices will receive a single OTA update with the October 05, 2016 security patch level.
Android and Google service mitigations
This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.
- Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
- The Android Security team actively monitors for abuse with Verify Apps and SafetyNet, which are designed to warn users about Potentially Harmful Applications. Verify Apps is enabled by default on devices with Google Mobile Services, and is especially important for users who install applications from outside of Google Play. Device rooting tools are prohibited within Google Play, but Verify Apps warns users when they attempt to install a detected rooting application—no matter where it comes from. Additionally, Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove the detected application.
- As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as Mediaserver.
Acknowledgements
We would like to thank these researchers for their contributions:
- Andre Teixeira Rizzo: CVE-2016-3882
- Andrea Biondo: CVE-2016-3921
- Daniel Micay of Copperhead Security: CVE-2016-3922
- Dmitry Vyukov of Google: CVE-2016-7117
- dosomder: CVE-2016-3931
- Ecular Xu (徐健) of Trend Micro: CVE-2016-3920
- Gengjia Chen (@chengjia4574) and pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd.: CVE-2016-6690, CVE-2016-3901, CVE-2016-6672, CVE-2016-3940, CVE-2016-3935
- Hang Zhang, Dongdong She, and Zhiyun Qian of UC Riverside: CVE-2015-8950
- Hao Chen of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3860
- Jann Horn of Google Project Zero: CVE-2016-3900, CVE-2016-3885
- Jason Rogena: CVE-2016-3917
- Jianqiang Zhao (@jianqiangzhao) and pjf of IceSword Lab, Qihoo 360: CVE-2016-6688, CVE-2016-6677, CVE-2016-6673, CVE-2016-6687, CVE-2016-6686, CVE-2016-6681, CVE-2016-6682, CVE-2016-3930
- Joshua Drake (@jduck): CVE-2016-3920
- Maciej Szawłowski of Google security team: CVE-2016-3905
- Mark Brand of Google Project Zero: CVE-2016-6689
- Michał Bednarski: CVE-2016-3914, CVE-2016-6674, CVE-2016-3911, CVE-2016-3912
- Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3933, CVE-2016-3932
- Nightwatch Cybersecurity Research (@nightwatchcyber): CVE-2016-5348
- Roee Hay, IBM Security X-Force Researcher: CVE-2016-6678
- Samuel Tan of Google: CVE-2016-3925
- Scott Bauer (@ScottyBauer1): CVE-2016-3936, CVE-2016-3928, CVE-2016-3902, CVE-2016-3937, CVE-2016-6696
- Seven Shen (@lingtongshen) of Trend Micro Mobile Threat Research Team: CVE-2016-6685, CVE-2016-6683, CVE-2016-6680, CVE-2016-6679, CVE-2016-3903, CVE-2016-6693, CVE-2016-6694, CVE-2016-6695
- Wenke Dou, Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3909
- Wenlin Yang and Guang Gong (龚广) (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3918
- Wish Wu (吴潍浠) (@wish_wu) of Trend Micro Inc.: CVE-2016-3924, CVE-2016-3915, CVE-2016-3916, CVE-2016-3910
- Yong Shi of Eagleye team, SCC, Huawei: CVE-2016-3938
- Zhanpeng Zhao (行之) (@0xr0ot) of Security Research Lab, Cheetah Mobile: CVE-2016-3908
2016-10-01 security patch level—Vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-10-01 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Elevation of privilege vulnerability in ServiceManager
An elevation of privilege in ServiceManager could enable a local malicious application to register arbitrary services that would normally be provided by a privileged process, such as the system_server. This issue is rated as High severity due to the possibility of service impersonation.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3900 | A-29431260 [2] | High | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 15, 2016 |
Elevation of privilege vulnerability in Lock Settings Service
An elevation of privilege vulnerability in Lock Settings Service could enable a local malicious application to clear the device PIN or password. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3908 | A-30003944 | High | All Nexus | 6.0, 6.0.1, 7.0 | Jul 6, 2016 |
Elevation of privilege vulnerability in Mediaserver
An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3909 | A-30033990 [2] | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 8, 2016 |
| CVE-2016-3910 | A-30148546 | High | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 13, 2016 |
| CVE-2016-3913 | A-30204103 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 18, 2016 |
Elevation of privilege vulnerability in Zygote process
An elevation of privilege in the Zygote process could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3911 | A-30143607 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 12, 2016 |
Elevation of privilege vulnerability in framework APIs
An elevation of privilege vulnerability in the framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3912 | A-30202481 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 17, 2016 |
Elevation of privilege vulnerability in Telephony
An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3914 | A-30481342 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 28, 2016 |
Elevation of privilege vulnerability in Camera service
An elevation of privilege vulnerability in the Camera service could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3915 | A-30591838 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Aug 1, 2016 |
| CVE-2016-3916 | A-30741779 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Aug 2, 2016 |
Elevation of privilege vulnerability in fingerprint login
An elevation of privilege vulnerability during fingerprint login could enable a malicious device owner to login as a different user account on the device. This issue is rated as High due to the possibility of a lockscreen bypass.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3917 | A-30744668 | High | All Nexus | 6.0.1, 7.0 | Aug 5, 2016 |
Information disclosure vulnerability in AOSP Mail
An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3918 | A-30745403 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Aug 5, 2016 |
Denial of service vulnerability in Wi-Fi
A denial of service vulnerability in Wi-Fi could enable a local proximate attacker to create a hotspot and cause a device reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3882 | A-29464811 | High | All Nexus | 6.0, 6.0.1, 7.0 | Jun 17, 2016 |
Denial of service vulnerability in GPS
A denial of service vulnerability in the GPS component could enable a remote attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-5348 | A-29555864 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 20, 2016 |
Denial of service vulnerability in Mediaserver
A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3920 | A-30744884 | High | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Aug 5, 2016 |
Elevation of privilege vulnerability in Framework Listener
An elevation of privilege vulnerability in Framework Listener could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3921 | A-29831647 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jun 25, 2016 |
Elevation of privilege vulnerability in Telephony
An elevation of privilege vulnerability in Telephony could enable a local malicious application to execute arbitrary code in the context of a privileged process. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3922 | A-30202619 | Moderate | All Nexus | 6.0, 6.0.1, 7.0 | Jul 17, 2016 |
Elevation of privilege vulnerability in Accessibility services
An elevation of privilege vulnerability in the Accessibility services could enable a local malicious application to generate unexpected touch events on the device that could lead to applications accepting permission dialogs without the user’s explicit consent. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation or user permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3923 | A-30647115 | Moderate | All Nexus | 7.0 | Google internal |
Information disclosure vulnerability in Mediaserver
An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3924 | A-30204301 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 | Jul 18, 2016 |
Denial of service vulnerability in Wi-Fi
A denial of service vulnerability in the Wi-Fi service could enable a local malicious application to prevent Wi-Fi calling. This issue is rated as Moderate due to the possibility of a denial of service to application functionality.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3925 | A-30230534 | Moderate | All Nexus | 6.0, 6.0.1, 7.0 | Google internal |
2016-10-05 security patch level—Vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-10-05 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Remote code execution vulnerability in kernel ASN.1 decoder
An elevation of privilege vulnerability in the kernel ASN.1 decoder could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-0758 | A-29814470 Upstream kernel |
Critical | Nexus 5X, Nexus 6P | May 12, 2016 |
Remote code execution vulnerability in kernel networking subsystem
A remote code execution vulnerability in the kernel networking subsystem could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-7117 | A-30515201 Upstream kernel |
Critical | All Nexus | Google internal |
Elevation of privilege vulnerability in MediaTek video driver
An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3928 | A-30019362* M-ALPS02829384 |
Critical | None | Jul 6, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in kernel shared memory driver
An elevation of privilege vulnerability in the kernel shared memory driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-5340 | A-30652312 QC-CR#1008948 |
Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Jul 26, 2016 |
Vulnerabilities in Qualcomm components
The table below contains security vulnerabilities affecting Qualcomm components and are described in further detail in the Qualcomm AMSS March 2016 and Qualcomm AMSS April 2016 security bulletins.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3926 | A-28823953* | Critical | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P | Qualcomm internal |
| CVE-2016-3927 | A-28823244* | Critical | Nexus 5X, Nexus 6P | Qualcomm internal |
| CVE-2016-3929 | A-28823675* | High | Nexus 5X, Nexus 6P | Qualcomm internal |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm networking component
An elevation of privilege vulnerability in the Qualcomm networking component could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2059 | A-27045580 QC-CR#974577 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Feb 4, 2016 |
Elevation of privilege vulnerability in NVIDIA MMC test driver
An elevation of privilege vulnerability in the NVIDIA MMC test driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3930 | A-28760138* N-CVE-2016-3930 |
High | Nexus 9 | May 12, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm QSEE Communicator driver
An elevation of privilege vulnerability in the Qualcomm QSEE Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3931 | A-29157595 QC-CR#1036418 |
High | Nexus 5X, Nexus 6, Nexus 6P, Android One | Jun 4, 2016 |
Elevation of privilege vulnerability in Mediaserver
An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3932 | A-29161895 M-ALPS02770870 |
High | None | Jun 6, 2016 |
| CVE-2016-3933 | A-29421408* N-CVE-2016-3933 |
High | Nexus 9, Pixel C | Jun 14, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm camera driver
An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3903 | A-29513227 QC-CR#1040857 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Jun 20, 2016 |
| CVE-2016-3934 | A-30102557 QC-CR#789704 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One | Jul 12, 2016 |
Elevation of privilege vulnerability in Qualcomm sound driver
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-8951 | A-30142668 QC-CR#948902 QC-CR#948902 |
High | Nexus 5X, Nexus 6P, Android One | Jun 20, 2016 |
Elevation of privilege vulnerability in Qualcomm crypto engine driver
An elevation of privilege vulnerability in the Qualcomm cryptographic engine driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3901 | A-29999161 QC-CR#1046434 |
High | Nexus 5X, Nexus 6, Nexus 6P, Android One | Jul 6, 2016 |
| CVE-2016-3935 | A-29999665 QC-CR#1046507 |
High | Nexus 5X, Nexus 6, Nexus 6P, Android One | Jul 6, 2016 |
Elevation of privilege vulnerability in MediaTek video driver
An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3936 | A-30019037* M-ALPS02829568 |
High | None | Jul 6, 2016 |
| CVE-2016-3937 | A-30030994* M-ALPS02834874 |
High | None | Jul 7, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm video driver
An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3938 | A-30019716 QC-CR#1049232 |
High | Nexus 5X, Nexus 6, Nexus 6P, Android One | Jul 7, 2016 |
| CVE-2016-3939 | A-30874196 QC-CR#1001224 |
High | Nexus 5X, Nexus 6, Nexus 6P, Android One | Aug 15, 2016 |
Elevation of privilege vulnerability in Synaptics touchscreen driver
An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3940 | A-30141991* | High | Nexus 6P, Android One | Jul 12, 2016 |
| CVE-2016-6672 | A-30537088* | High | Nexus 5X | Jul 31, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in NVIDIA camera driver
An elevation of privilege vulnerability in the NVIDIA camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6673 | A-30204201* N-CVE-2016-6673 |
High | Nexus 9 | Jul 17, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in system_server
An elevation of privilege vulnerability in system_server could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6674 | A-30445380* | High | All Nexus | Jul 26, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm Wi-Fi driver
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3905 | A-28061823 QC-CR#1001449 |
High | Nexus 5X | Google internal |
| CVE-2016-6675 | A-30873776 QC-CR#1000861 |
High | Nexus 5X, Android One | Aug 15, 2016 |
| CVE-2016-6676 | A-30874066 QC-CR#1000853 |
High | Nexus 5X, Android One | Aug 15, 2016 |
| CVE-2016-5342 | A-30878283 QC-CR#1032174 |
High | Android One | Aug 15, 2016 |
Elevation of privilege vulnerability in kernel performance subsystem
An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-8955 | A-29508816 Upstream kernel |
High | Nexus 5X, Nexus 6P, Pixel C, Android One | Google internal |
Information disclosure vulnerability in kernel ION subsystem
An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-8950 | A-29795245 QC-CR#1041735 |
High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P | May 12, 2016 |
Information disclosure vulnerability in NVIDIA GPU driver
An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6677 | A-30259955* N-CVE-2016-6677 |
High | Nexus 9 | Jul 19, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm character driver
An elevation of privilege vulnerability in the Qualcomm character driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process, and the vulnerable code is currently not accessible.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-0572 | A-29156684 QC-CR#848489 |
Moderate | Nexus 5X, Nexus 6P | May 28, 2016 |
Information disclosure vulnerability in Qualcomm sound driver
An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3860 | A-29323142 QC-CR#1038127 |
Moderate | Nexus 5X, Nexus 6P, Android One | Jun 13, 2016 |
Information disclosure vulnerability in Motorola USBNet driver
An information disclosure vulnerability in the Motorola USBNet driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6678 | A-29914434* | Moderate | Nexus 6 | Jun 30, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in Qualcomm components
An information disclosure vulnerability in Qualcomm components, including the sound driver, IPA driver and Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6679 | A-29915601 QC-CR#1000913 [2] |
Moderate | Nexus 5X, Android One | Jun 30, 2016 |
| CVE-2016-3902 | A-29953313* QC-CR#1044072 |
Moderate | Nexus 5X, Nexus 6P, | Jul 2, 2016 |
| CVE-2016-6680 | A-29982678* QC-CR#1048052 |
Moderate | Nexus 5X, Android One | Jul 3, 2016 |
| CVE-2016-6681 | A-30152182 QC-CR#1049521 |
Moderate | Nexus 5X, Nexus 6P, Android One | Jul 14, 2016 |
| CVE-2016-6682 | A-30152501 QC-CR#1049615 |
Moderate | Nexus 5X, Nexus 6P, Android One | Jul 14, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in kernel components
An information disclosure vulnerability in kernel components, including Binder, Sync, Bluetooth, and Sound driver, could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6683 | A-30143283* | Moderate | All Nexus | Jul 13, 2016 |
| CVE-2016-6684 | A-30148243* | Moderate | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Android One | Jul 13, 2016 |
| CVE-2015-8956 | A-30149612* | Moderate | Nexus 5, Nexus 6P, Android One | Jul 14, 2016 |
| CVE-2016-6685 | A-30402628* | Moderate | Nexus 6P | Jul 25, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in NVIDIA profiler
An information disclosure vulnerability in the NVIDIA profiler could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6686 | A-30163101* N-CVE-2016-6686 |
Moderate | Nexus 9 | Jul 15, 2016 |
| CVE-2016-6687 | A-30162222* N-CVE-2016-6687 |
Moderate | Nexus 9 | Jul 15, 2016 |
| CVE-2016-6688 | A-30593080* N-CVE-2016-6688 |
Moderate | Nexus 9 | Aug 2, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in kernel
An information disclosure vulnerability in Binder could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6689 | A-30768347* | Moderate | All Nexus | Aug 9, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Denial of service vulnerability in kernel networking subsystem
A denial of service vulnerability in the kernel networking subsystem could enable an attacker to block access to TCP connections and cause a temporary remote denial of service. This issue is rated as Moderate because cellular services are still available and the device is still usable.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-5696 | A-30809774 Upstream kernel |
Moderate | Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One | Jul 12, 2016 |
Denial of service vulnerability in kernel sound driver
A denial of service vulnerability in the kernel could allow a local malicious application to cause a device reboot. This issue is rated as Low because it is a temporary denial of service.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6690 | A-28838221* | Low | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus Player | May 18, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Vulnerabilities in Qualcomm components
The table below contains a list of security vulnerabilities that affect Qualcomm components.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-6691 | QC-CR#978452 | High | None | Jul 2016 |
| CVE-2016-6692 | QC-CR#1004933 | High | None | Aug 2016 |
| CVE-2016-6693 | QC-CR#1027585 | High | None | Aug 2016 |
| CVE-2016-6694 | QC-CR#1033525 | High | None | Aug 2016 |
| CVE-2016-6695 | QC-CR#1033540 | High | None | Aug 2016 |
| CVE-2016-6696 | QC-CR#1041130 | High | None | Aug 2016 |
| CVE-2016-5344 | QC-CR#993650 | Moderate | None | Aug 2016 |
| CVE-2016-5343 | QC-CR#1010081 | Moderate | None | Aug 2016 |
Common Questions and Answers
This section answers common questions that may occur after reading this bulletin.
1. How do I determine if my device is updated to address these issues?
Security Patch Levels of 2016-10-01 or later address all issues associated with the 2016-10-01 security patch string level. Security Patch Levels of 2016-10-05 or later address all issues associated with the 2016-10-05 security patch string level. Refer to the help center for instructions on how to check the security patch level. Device manufacturers that include these updates should set the patch string level to: [ro.build.version.security_patch]:[2016-10-01] or [ro.build.version.security_patch]:[2016-10-05].
2. Why does this bulletin have two security patch level strings?
This bulletin has two security patch level strings so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level string.
Devices that use the security patch level of October 5, 2016 or newer must include all applicable patches in this (and previous) security bulletins.
Devices that use the October 1, 2016 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.
3. How do I determine which Nexus devices are affected by each issue?
In the 2016-10-01 and 2016-10-05 security vulnerability details sections, each table has an Updated Nexus devices column that covers the range of affected Nexus devices updated for each issue. This column has a few options:
- All Nexus devices: If an issue affects all Nexus devices, the table will have “All Nexus” in the Updated Nexus devices column. “All Nexus” encapsulates the following supported devices: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Nexus Player and Pixel C.
- Some Nexus devices: If an issue doesn’t affect all Nexus devices, the affected Nexus devices are listed in the Updated Nexus devices column.
- No Nexus devices: If no Nexus devices running Android 7.0 are affected by the issue, the table will have “None” in the Updated Nexus devices column.
4. What do the entries in the references column map to?
Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. These prefixes map as follows:
| Prefix | Reference |
|---|---|
| A- | Android bug ID |
| QC- | Qualcomm reference number |
| M- | MediaTek reference number |
| N- | NVIDIA reference number |
| B- | Broadcom reference number |
Revisions
- October 03, 2016: Bulletin published.
- October 04, 2016: Bulletin revised to include AOSP links and update attributions for CVE-2016-3920, CVE-2016-6693, CVE-2016-6694, CVE-2016-6695, and CVE-2016-6696.