Android Security Bulletin—October 2016

Published October 03, 2016 | Updated October 04, 2016

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware images have also been released to the Google Developer site. Security Patch Levels of October 05, 2016 or later address these issues. Refer to the documentation to learn how to check the security patch level. Supported Nexus devices will receive a single OTA update with the October 05, 2016 security patch level.

Partners were notified about the issues described in the bulletin on September 06, 2016 or earlier. Where applicable, source code patches for these issues have been released to the Android Open Source Project (AOSP) repository. This bulletin also includes links to patches outside of AOSP.

The most severe of these issues are Critical security vulnerabilities in device-specific code that could enable remote code execution within the context of the kernel, leading to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.

We have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the Android and Google service mitigations section for details on the Android security platform protections and service protections such as SafetyNet, which improve the security of the Android platform.

We encourage all customers to accept these updates to their devices.

Announcements

  • This bulletin has two security patch level strings to provide Android partners with the flexibility to more quickly fix a subset of vulnerabilities that are similar across all Android devices. See Common questions and answers for additional information:
    • 2016-10-01: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-10-01 (and all previous security patch level strings) are addressed.
    • 2016-10-05: Complete security patch level string. This security patch level string indicates that all issues associated with 2016-10-01 and 2016-10-05 (and all previous security patch level strings) are addressed.
  • Supported Nexus devices will receive a single OTA update with the October 05, 2016 security patch level.

Android and Google service mitigations

This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.

  • Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
  • The Android Security team actively monitors for abuse with Verify Apps and SafetyNet, which are designed to warn users about Potentially Harmful Applications. Verify Apps is enabled by default on devices with Google Mobile Services, and is especially important for users who install applications from outside of Google Play. Device rooting tools are prohibited within Google Play, but Verify Apps warns users when they attempt to install a detected rooting application—no matter where it comes from. Additionally, Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove the detected application.
  • As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as Mediaserver.

Acknowledgements

We would like to thank these researchers for their contributions:

  • Andre Teixeira Rizzo: CVE-2016-3882
  • Andrea Biondo: CVE-2016-3921
  • Daniel Micay of Copperhead Security: CVE-2016-3922
  • Dmitry Vyukov of Google: CVE-2016-7117
  • dosomder: CVE-2016-3931
  • Ecular Xu (徐健) of Trend Micro: CVE-2016-3920
  • Gengjia Chen (@chengjia4574) and pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd.: CVE-2016-6690, CVE-2016-3901, CVE-2016-6672, CVE-2016-3940, CVE-2016-3935
  • Hang Zhang, Dongdong She, and Zhiyun Qian of UC Riverside: CVE-2015-8950
  • Hao Chen of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3860
  • Jann Horn of Google Project Zero: CVE-2016-3900, CVE-2016-3885
  • Jason Rogena: CVE-2016-3917
  • Jianqiang Zhao (@jianqiangzhao) and pjf of IceSword Lab, Qihoo 360: CVE-2016-6688, CVE-2016-6677, CVE-2016-6673, CVE-2016-6687, CVE-2016-6686, CVE-2016-6681, CVE-2016-6682, CVE-2016-3930
  • Joshua Drake (@jduck): CVE-2016-3920
  • Maciej Szawłowski of Google security team: CVE-2016-3905
  • Mark Brand of Google Project Zero: CVE-2016-6689
  • Michał Bednarski: CVE-2016-3914, CVE-2016-6674, CVE-2016-3911, CVE-2016-3912
  • Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3933, CVE-2016-3932
  • Nightwatch Cybersecurity Research (@nightwatchcyber): CVE-2016-5348
  • Roee Hay, IBM Security X-Force Researcher: CVE-2016-6678
  • Samuel Tan of Google: CVE-2016-3925
  • Scott Bauer (@ScottyBauer1): CVE-2016-3936, CVE-2016-3928, CVE-2016-3902, CVE-2016-3937, CVE-2016-6696
  • Seven Shen (@lingtongshen) of Trend Micro Mobile Threat Research Team: CVE-2016-6685, CVE-2016-6683, CVE-2016-6680, CVE-2016-6679, CVE-2016-3903, CVE-2016-6693, CVE-2016-6694, CVE-2016-6695
  • Wenke Dou, Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3909
  • Wenlin Yang and Guang Gong (龚广) (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3918
  • Wish Wu (吴潍浠) (@wish_wu) of Trend Micro Inc.: CVE-2016-3924, CVE-2016-3915, CVE-2016-3916, CVE-2016-3910
  • Yong Shi of Eagleye team, SCC, Huawei: CVE-2016-3938
  • Zhanpeng Zhao (行之) (@0xr0ot) of Security Research Lab, Cheetah Mobile: CVE-2016-3908

2016-10-01 security patch level—Vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-10-01 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.

Elevation of privilege vulnerability in ServiceManager

An elevation of privilege in ServiceManager could enable a local malicious application to register arbitrary services that would normally be provided by a privileged process, such as the system_server. This issue is rated as High severity due to the possibility of service impersonation.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3900 A-29431260 [2] High All Nexus 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 15, 2016

Elevation of privilege vulnerability in Lock Settings Service

An elevation of privilege vulnerability in Lock Settings Service could enable a local malicious application to clear the device PIN or password. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3908 A-30003944 High All Nexus 6.0, 6.0.1, 7.0 Jul 6, 2016

Elevation of privilege vulnerability in Mediaserver

An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3909 A-30033990 [2] High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 8, 2016
CVE-2016-3910 A-30148546 High All Nexus 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 13, 2016
CVE-2016-3913 A-30204103 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 18, 2016

Elevation of privilege vulnerability in Zygote process

An elevation of privilege in the Zygote process could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3911 A-30143607 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 12, 2016

Elevation of privilege vulnerability in framework APIs

An elevation of privilege vulnerability in the framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3912 A-30202481 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 17, 2016

Elevation of privilege vulnerability in Telephony

An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3914 A-30481342 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 28, 2016

Elevation of privilege vulnerability in Camera service

An elevation of privilege vulnerability in the Camera service could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3915 A-30591838 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Aug 1, 2016
CVE-2016-3916 A-30741779 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Aug 2, 2016

Elevation of privilege vulnerability in fingerprint login

An elevation of privilege vulnerability during fingerprint login could enable a malicious device owner to login as a different user account on the device. This issue is rated as High due to the possibility of a lockscreen bypass.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3917 A-30744668 High All Nexus 6.0.1, 7.0 Aug 5, 2016

Information disclosure vulnerability in AOSP Mail

An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to access data without permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3918 A-30745403 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Aug 5, 2016

Denial of service vulnerability in Wi-Fi

A denial of service vulnerability in Wi-Fi could enable a local proximate attacker to create a hotspot and cause a device reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3882 A-29464811 High All Nexus 6.0, 6.0.1, 7.0 Jun 17, 2016

Denial of service vulnerability in GPS

A denial of service vulnerability in the GPS component could enable a remote attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-5348 A-29555864 High All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 20, 2016

Denial of service vulnerability in Mediaserver

A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3920 A-30744884 High All Nexus 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Aug 5, 2016

Elevation of privilege vulnerability in Framework Listener

An elevation of privilege vulnerability in Framework Listener could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3921 A-29831647 Moderate All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 25, 2016

Elevation of privilege vulnerability in Telephony

An elevation of privilege vulnerability in Telephony could enable a local malicious application to execute arbitrary code in the context of a privileged process. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3922 A-30202619 Moderate All Nexus 6.0, 6.0.1, 7.0 Jul 17, 2016

Elevation of privilege vulnerability in Accessibility services

An elevation of privilege vulnerability in the Accessibility services could enable a local malicious application to generate unexpected touch events on the device that could lead to applications accepting permission dialogs without the user’s explicit consent. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation or user permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3923 A-30647115 Moderate All Nexus 7.0 Google internal

Information disclosure vulnerability in Mediaserver

An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3924 A-30204301 Moderate All Nexus 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 18, 2016

Denial of service vulnerability in Wi-Fi

A denial of service vulnerability in the Wi-Fi service could enable a local malicious application to prevent Wi-Fi calling. This issue is rated as Moderate due to the possibility of a denial of service to application functionality.

CVE References Severity Updated Nexus devices Updated AOSP versions Date reported
CVE-2016-3925 A-30230534 Moderate All Nexus 6.0, 6.0.1, 7.0 Google internal

2016-10-05 security patch level—Vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-10-05 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.

Remote code execution vulnerability in kernel ASN.1 decoder

An elevation of privilege vulnerability in the kernel ASN.1 decoder could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-0758 A-29814470
Upstream kernel
Critical Nexus 5X, Nexus 6P May 12, 2016

Remote code execution vulnerability in kernel networking subsystem

A remote code execution vulnerability in the kernel networking subsystem could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-7117 A-30515201
Upstream kernel
Critical All Nexus Google internal

Elevation of privilege vulnerability in MediaTek video driver

An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3928 A-30019362*
M-ALPS02829384
Critical None Jul 6, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in kernel shared memory driver

An elevation of privilege vulnerability in the kernel shared memory driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-5340 A-30652312
QC-CR#1008948
Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Jul 26, 2016

Vulnerabilities in Qualcomm components

The table below contains security vulnerabilities affecting Qualcomm components and are described in further detail in the Qualcomm AMSS March 2016 and Qualcomm AMSS April 2016 security bulletins.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3926 A-28823953* Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P Qualcomm internal
CVE-2016-3927 A-28823244* Critical Nexus 5X, Nexus 6P Qualcomm internal
CVE-2016-3929 A-28823675* High Nexus 5X, Nexus 6P Qualcomm internal

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm networking component

An elevation of privilege vulnerability in the Qualcomm networking component could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-2059 A-27045580
QC-CR#974577
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Feb 4, 2016

Elevation of privilege vulnerability in NVIDIA MMC test driver

An elevation of privilege vulnerability in the NVIDIA MMC test driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3930 A-28760138*
N-CVE-2016-3930
High Nexus 9 May 12, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm QSEE Communicator driver

An elevation of privilege vulnerability in the Qualcomm QSEE Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3931 A-29157595
QC-CR#1036418
High Nexus 5X, Nexus 6, Nexus 6P, Android One Jun 4, 2016

Elevation of privilege vulnerability in Mediaserver

An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3932 A-29161895
M-ALPS02770870
High None Jun 6, 2016
CVE-2016-3933 A-29421408*
N-CVE-2016-3933
High Nexus 9, Pixel C Jun 14, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm camera driver

An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3903 A-29513227
QC-CR#1040857
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Jun 20, 2016
CVE-2016-3934 A-30102557
QC-CR#789704
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One Jul 12, 2016

Elevation of privilege vulnerability in Qualcomm sound driver

An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-8951 A-30142668
QC-CR#948902
QC-CR#948902
High Nexus 5X, Nexus 6P, Android One Jun 20, 2016

Elevation of privilege vulnerability in Qualcomm crypto engine driver

An elevation of privilege vulnerability in the Qualcomm cryptographic engine driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3901 A-29999161
QC-CR#1046434
High Nexus 5X, Nexus 6, Nexus 6P, Android One Jul 6, 2016
CVE-2016-3935 A-29999665
QC-CR#1046507
High Nexus 5X, Nexus 6, Nexus 6P, Android One Jul 6, 2016

Elevation of privilege vulnerability in MediaTek video driver

An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3936 A-30019037*
M-ALPS02829568
High None Jul 6, 2016
CVE-2016-3937 A-30030994*
M-ALPS02834874
High None Jul 7, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm video driver

An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3938 A-30019716
QC-CR#1049232
High Nexus 5X, Nexus 6, Nexus 6P, Android One Jul 7, 2016
CVE-2016-3939 A-30874196
QC-CR#1001224
High Nexus 5X, Nexus 6, Nexus 6P, Android One Aug 15, 2016

Elevation of privilege vulnerability in Synaptics touchscreen driver

An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3940 A-30141991* High Nexus 6P, Android One Jul 12, 2016
CVE-2016-6672 A-30537088* High Nexus 5X Jul 31, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in NVIDIA camera driver

An elevation of privilege vulnerability in the NVIDIA camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6673 A-30204201*
N-CVE-2016-6673
High Nexus 9 Jul 17, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in system_server

An elevation of privilege vulnerability in system_server could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6674 A-30445380* High All Nexus Jul 26, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm Wi-Fi driver

An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3905 A-28061823
QC-CR#1001449
High Nexus 5X Google internal
CVE-2016-6675 A-30873776
QC-CR#1000861
High Nexus 5X, Android One Aug 15, 2016
CVE-2016-6676 A-30874066
QC-CR#1000853
High Nexus 5X, Android One Aug 15, 2016
CVE-2016-5342 A-30878283
QC-CR#1032174
High Android One Aug 15, 2016

Elevation of privilege vulnerability in kernel performance subsystem

An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-8955 A-29508816
Upstream kernel
High Nexus 5X, Nexus 6P, Pixel C, Android One Google internal

Information disclosure vulnerability in kernel ION subsystem

An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-8950 A-29795245
QC-CR#1041735
High Nexus 5, Nexus 5X, Nexus 6, Nexus 6P May 12, 2016

Information disclosure vulnerability in NVIDIA GPU driver

An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6677 A-30259955*
N-CVE-2016-6677
High Nexus 9 Jul 19, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Elevation of privilege vulnerability in Qualcomm character driver

An elevation of privilege vulnerability in the Qualcomm character driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process, and the vulnerable code is currently not accessible.

CVE References Severity Updated Nexus devices Date reported
CVE-2015-0572 A-29156684
QC-CR#848489
Moderate Nexus 5X, Nexus 6P May 28, 2016

Information disclosure vulnerability in Qualcomm sound driver

An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-3860 A-29323142
QC-CR#1038127
Moderate Nexus 5X, Nexus 6P, Android One Jun 13, 2016

Information disclosure vulnerability in Motorola USBNet driver

An information disclosure vulnerability in the Motorola USBNet driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6678 A-29914434* Moderate Nexus 6 Jun 30, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in Qualcomm components

An information disclosure vulnerability in Qualcomm components, including the sound driver, IPA driver and Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6679 A-29915601
QC-CR#1000913 [2]
Moderate Nexus 5X, Android One Jun 30, 2016
CVE-2016-3902 A-29953313*
QC-CR#1044072
Moderate Nexus 5X, Nexus 6P, Jul 2, 2016
CVE-2016-6680 A-29982678*
QC-CR#1048052
Moderate Nexus 5X, Android One Jul 3, 2016
CVE-2016-6681 A-30152182
QC-CR#1049521
Moderate Nexus 5X, Nexus 6P, Android One Jul 14, 2016
CVE-2016-6682 A-30152501
QC-CR#1049615
Moderate Nexus 5X, Nexus 6P, Android One Jul 14, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in kernel components

An information disclosure vulnerability in kernel components, including Binder, Sync, Bluetooth, and Sound driver, could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6683 A-30143283* Moderate All Nexus Jul 13, 2016
CVE-2016-6684 A-30148243* Moderate Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Android One Jul 13, 2016
CVE-2015-8956 A-30149612* Moderate Nexus 5, Nexus 6P, Android One Jul 14, 2016
CVE-2016-6685 A-30402628* Moderate Nexus 6P Jul 25, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in NVIDIA profiler

An information disclosure vulnerability in the NVIDIA profiler could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6686 A-30163101*
N-CVE-2016-6686
Moderate Nexus 9 Jul 15, 2016
CVE-2016-6687 A-30162222*
N-CVE-2016-6687
Moderate Nexus 9 Jul 15, 2016
CVE-2016-6688 A-30593080*
N-CVE-2016-6688
Moderate Nexus 9 Aug 2, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Information disclosure vulnerability in kernel

An information disclosure vulnerability in Binder could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6689 A-30768347* Moderate All Nexus Aug 9, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Denial of service vulnerability in kernel networking subsystem

A denial of service vulnerability in the kernel networking subsystem could enable an attacker to block access to TCP connections and cause a temporary remote denial of service. This issue is rated as Moderate because cellular services are still available and the device is still usable.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-5696 A-30809774
Upstream kernel
Moderate Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Jul 12, 2016

Denial of service vulnerability in kernel sound driver

A denial of service vulnerability in the kernel could allow a local malicious application to cause a device reboot. This issue is rated as Low because it is a temporary denial of service.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6690 A-28838221* Low Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus Player May 18, 2016

* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.

Vulnerabilities in Qualcomm components

The table below contains a list of security vulnerabilities that affect Qualcomm components.

CVE References Severity Updated Nexus devices Date reported
CVE-2016-6691 QC-CR#978452 High None Jul 2016
CVE-2016-6692 QC-CR#1004933 High None Aug 2016
CVE-2016-6693 QC-CR#1027585 High None Aug 2016
CVE-2016-6694 QC-CR#1033525 High None Aug 2016
CVE-2016-6695 QC-CR#1033540 High None Aug 2016
CVE-2016-6696 QC-CR#1041130 High None Aug 2016
CVE-2016-5344 QC-CR#993650 Moderate None Aug 2016
CVE-2016-5343 QC-CR#1010081 Moderate None Aug 2016

Common Questions and Answers

This section answers common questions that may occur after reading this bulletin.

1. How do I determine if my device is updated to address these issues?

Security Patch Levels of 2016-10-01 or later address all issues associated with the 2016-10-01 security patch string level. Security Patch Levels of 2016-10-05 or later address all issues associated with the 2016-10-05 security patch string level. Refer to the help center for instructions on how to check the security patch level. Device manufacturers that include these updates should set the patch string level to: [ro.build.version.security_patch]:[2016-10-01] or [ro.build.version.security_patch]:[2016-10-05].

2. Why does this bulletin have two security patch level strings?

This bulletin has two security patch level strings so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level string.

Devices that use the security patch level of October 5, 2016 or newer must include all applicable patches in this (and previous) security bulletins.

Devices that use the October 1, 2016 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.

3. How do I determine which Nexus devices are affected by each issue?

In the 2016-10-01 and 2016-10-05 security vulnerability details sections, each table has an Updated Nexus devices column that covers the range of affected Nexus devices updated for each issue. This column has a few options:

  • All Nexus devices: If an issue affects all Nexus devices, the table will have “All Nexus” in the Updated Nexus devices column. “All Nexus” encapsulates the following supported devices: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Android One, Nexus Player and Pixel C.
  • Some Nexus devices: If an issue doesn’t affect all Nexus devices, the affected Nexus devices are listed in the Updated Nexus devices column.
  • No Nexus devices: If no Nexus devices running Android 7.0 are affected by the issue, the table will have “None” in the Updated Nexus devices column.

4. What do the entries in the references column map to?

Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. These prefixes map as follows:

Prefix Reference
A- Android bug ID
QC- Qualcomm reference number
M- MediaTek reference number
N- NVIDIA reference number
B- Broadcom reference number

Revisions

  • October 03, 2016: Bulletin published.
  • October 04, 2016: Bulletin revised to include AOSP links and update attributions for CVE-2016-3920, CVE-2016-6693, CVE-2016-6694, CVE-2016-6695, and CVE-2016-6696.