Nexus Security Bulletin - August 2015

Published August 13, 2015

We have released a security update to Nexus devices through an over-the-air (OTA) update as part of our Android Security Bulletin Monthly Release process. The Nexus firmware images have also been released to the Google Developer site. Builds LMY48I or later address these issues. Partners were notified about these issues on June 25, 2015 or earlier.

The most severe of these issues is a Critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.

Mitigations

This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities can be successfully exploited on Android.

  • Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
  • The Android Security team is actively monitoring for abuse with Verify Apps and SafetyNet which will warn about potentially harmful applications about to be installed. Device rooting tools are prohibited within Google Play. To protect users who install applications from outside of Google Play, Verify Apps is enabled by default and will warn users about known rooting applications. Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove any such applications.
  • As appropriate, Google has updated the Hangouts and Messenger applications so that media is not automatically passed to vulnerable processes (such as mediaserver.)

Acknowledgements

We would like to thank these researchers for their contributions:

  • Joshua Drake: CVE-2015-1538, CVE-2015-3826
  • Ben Hawkes: CVE-2015-3836
  • Alexandru Blanda: CVE-2015-3832
  • Michał Bednarski: CVE-2015-3831, CVE-2015-3844, CVE-2015-1541
  • Alex Copot: CVE-2015-1536
  • Alex Eubanks: CVE-2015-0973
  • Roee Hay and Or Peles: CVE-2015-3837
  • Guang Gong: CVE-2015-3834
  • Gal Beniamini: CVE-2015-3835
  • Wish Wu*: CVE-2015-3842
  • Artem Chaykin: CVE-2015-3843

*Wish is also our very first Android Security Rewards recipient!

Integer overflows during MP4 atom processing

There are several potential integer overflows in libstagefright that could occur during MP4 atom processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access. Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-1538 ANDROID-20139950 [2] Critical 5.1 and below

An integer underflow in ESDS processing

There is a potential integer underflow in libstagefright that could occur during ESDS atom processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access. Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-1539 ANDROID-20139950 Critical 5.1 and below

Integer overflow in libstagefright when parsing the MPEG4 tx3g atom

There is a potential integer overflow in libstagefright that could occur during MPEG4 tx3g data processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3824 ANDROID-20923261 Critical 5.1 and below

Integer underflow in libstagefright when processing MPEG4 covr atoms

There is a potential integer underflow in libstagefright that could occur during MPEG4 data processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3827 ANDROID-20923261 Critical 5.1 and below

Integer underflow in libstagefright if size is below 6 while processing 3GPP metadata

There is a potential integer underflow in libstagefright that could occur during 3GPP data processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access. Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3828 ANDROID-20923261 Critical 5.0 and above

Integer overflow in libstagefright processing MPEG4 covr atoms when chunk_data_size is SIZE_MAX

There is a potential integer overflow in libstagefright that could occur during MPEG4 covr data processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access. Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3829 ANDROID-20923261 Critical 5.0 and above

Buffer overflow in Sonivox Parse_wave

There is a potential buffer overflow in Sonivox that could occur during XMF data processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access. Note that under our previous severity rating guidelines, this was rated as a High severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3836 ANDROID-21132860 Critical 5.1 and below

Buffer overflows in libstagefright MPEG4Extractor.cpp

There are several buffer overflows in libstagefright that could occur during MP4 processing, leading to memory corruption and potentially remote code execution as the mediaserver process.

The affected functionality is provided as an application API and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution as the privileged mediaserver service. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

Initially this issue was reported as a local exploit (not remotely accessible). Note that under our previous severity rating guidelines, this was rated as a Moderate severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a Critical severity issue.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3832 ANDROID-19641538 Critical 5.1 and below

Buffer overflow in mediaserver BpMediaHTTPConnection

There is a potential buffer overflow in BpMediaHTTPConnection when processing data provided by another application, leading to memory corruption and potentially code execution as the mediaserver process.

The affected functionality is provided as an application API. We don’t believe the issue is remotely exploitable.

This issue is rated as a High severity due to the possibility of code execution as the privileged mediaserver service, from a local application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3831 ANDROID-19400722 High 5.0 and 5.1

Vulnerability in libpng: Overflow in png_Read_IDAT_data

There is a potential buffer overflow that could occur in reading IDAT data within the png_read_IDAT_data() function in libpng, leading to memory corruption and potentially remote code execution within an application using this method.

The affected functionality is provided as an application API. There may be applications that allow it to be reached with remote content, most notably messaging applications and browsers.

This issue is rated as a High severity due to the possibility of remote code execution as an unprivileged application.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-0973 ANDROID-19499430 High 5.1 and below

Remotely exploitable memcpy() overflow in p2p_add_device() in wpa_supplicant

When wpa_supplicant is operating in WLAN Direct mode, it's vulnerable to potential remote code execution due to an overflow in the p2p_add_device() method. Successful exploitation could result in code execution as the 'wifi' user in Android.

There are several mitigations that can effect successful exploitation of this issue:

- WLAN Direct is not enabled by default on most Android devices

- Exploitation requires an attacker to be locally proximate (within WiFi range)

- The wpa_supplicant process runs as the 'wifi' user which has limited access to the system

- Remote exploitation is mitigated by ASLR on Android 4.1 and later devices.

- The wpa_supplicant process is tightly constrained by SELinux policy on Android 5.0 and greater

This issue is rated as High severity due to the possibility of remote code execution. While the 'wifi' service does have capabilities that are not normally accessible to 3rd party apps which could rate this as Critical, we believe the limited capabilities and level of mitigation warrant decreasing the severity to High.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-1863 ANDROID-20076874 High 5.1 and below

Memory Corruption in OpenSSLX509Certificate Deserialization

A malicious local application can send an Intent which, when deserialized by the receiving application, can decrement a value at an arbitrary memory address, leading to memory corruption and potentially code execution within the receiving application.

This issue is rated as High severity because it can be used to gain privileges not accessible to a third-party application.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3837 ANDROID-21437603 High 5.1 and below

Buffer overflow in mediaserver BnHDCP

There is a potential integer overflow in libstagefright when processing data provided by another application, leading to memory (heap) corruption and potentially code execution as the mediaserver process.

This issue is rated as High severity because it can be used to gain privileges not accessible to a third-party application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

Note that under our previous severity rating guidelines, this was rated as a Moderate severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a High severity vulnerability.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3834 ANDROID-20222489 High 5.1 and below

Buffer overflow in libstagefright OMXNodeInstance::emptyBuffer

There is a potential buffer overflow in libstagefright when processing data provided by another application, leading to memory corruption and potentially code execution as the mediaserver process.

This issue is rated as High severity because it can be used to gain privileges not accessible to a third-party application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

Note that under our previous severity rating guidelines, this was rated as a Moderate severity vulnerability and was reported to partners as such. Under our new guidelines, published in June 2015, it is a High severity vulnerability.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3835 ANDROID-20634516 [2] High 5.1 and below

Heap overflow in mediaserver AudioPolicyManager::getInputForAttr()

There is a heap overflow in mediaserver's Audio Policy Service that could allow a local application to execute arbitrary code in mediaserver's process.

The affected functionality is provided as an application API. We don’t believe the issue is remotely exploitable.

This issue is rated as a High severity due to the possibility of code execution as the privileged mediaserver service, from a local application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3842 ANDROID-21953516 High 5.1 and below

Applications can intercept or emulate SIM commands to Telephony

There is a vulnerability in the SIM Toolkit (STK) framework that could allow apps to intercept or emulate certain STK SIM commands to Android's Telephony subsystem.

This issue is rated at a High severity because it could allow an unprivileged app to access capabilities or data normally protected by a "signature" or "system" level permission.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3843 ANDROID-21697171 [2, 3, 4] High 5.1 and below

Vulnerability in Bitmap unmarshalling

An integer overflow in Bitmap_createFromParcel() could allow an app to either crash the system_server process or read memory data from system_server.

This issue is rated as Moderate severity due to the possibility of leaking sensitive data from the system_server process to an unprivileged local process. While this type of vulnerability would normally be rated as High severity, the severity has been reduced because the data that is leaked in a successful attack cannot be controlled by the attacking process and the consequence of an unsuccessful attack is to render the device temporarily unusable (requiring a reboot).

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-1536 ANDROID-19666945 Moderate 5.1 and below

AppWidgetServiceImpl can create IntentSender with system privileges

There is a vulnerability in AppWidgetServiceImpl in the Settings app that allows an app to grant itself a URI permission by specifying FLAG_GRANT_READ/WRITE_URI_PERMISSION. For example, this could be exploited to read contact data without the READ_CONTACTS permission.

This is rated as a Moderate severity vulnerability because it can allow a local app to access data normally protected by permissions with a "dangerous" protection level.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-1541 ANDROID-19618745 Moderate 5.1

Mitigation bypass of restrictions on getRecentTasks()

A local application can reliably determine the foreground application, circumventing the getRecentTasks() restriction introduced in Android 5.0.

This is rated as a moderate severity vulnerability because it can allow a local app to access data normally protected by permissions with a "dangerous" protection level.

We believe this vulnerability was first described publicly on Stack Overflow.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3833 ANDROID-20034603 Moderate 5.0 and 5.1

ActivityManagerService.getProcessRecordLocked() may load a system UID application into the wrong process

ActivityManager's getProcessRecordLocked() method doesn't properly verify that an application's process name matches the corresponding package name. In some cases, this can allow ActivityManager to load the wrong process for certain tasks.

The implications are that an app can prevent Settings from being loaded or inject parameters for Settings fragments. We don't believe that this vulnerability can be used to execute arbitrary code as the "system" user.

While the ability to access capabilities normally only accessible to "system" would be rated as a High severity, we rated this one as a Moderate due to the limited level of access granted by the vulnerability.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3844 ANDROID-21669445 Moderate 5.1 and below

Unbounded buffer read in libstagefright while parsing 3GPP metadata

An integer underflow during parsing of 3GPP data can result in a read operation overrunning a buffer, causing mediaserver to crash.

This issue was originally rated as a High severity and was reported to partners as such, but after further investigation it has been downgraded to Low severity as the impact is limited to crashing mediaserver.

CVE Bug(s) with AOSP links Severity Affected versions
CVE-2015-3826 ANDROID-20923261 Low 5.0 and 5.1

Revisions

  • August 13, 2015: Originally Published