CVE-2016-6707
Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An elevation of privilege vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-31350622.
Una vulnerabilidad de elevación de privilegio en System Server en Android 6.x en versiones anteriores a 01-11-2016 y 7.0 en versiones anteriores a 01-11-2016 podría habilitar a una aplicación maliciosa local a ejecutar código arbitrario dentro del contexto de un proceso privilegiado. Este problema está clasificado como High porque puede ser usado para obtener acceso local a capacidades elevadas, las cuales no son normalmente accesibles a aplicaciones de terceros. Android ID: A-31350622.
Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order to conserve memory, there exists a code path which allows Bitmaps to be shared between processes by providing an ashmem-mapped file descriptor containing the Bitmap's raw pixel data. The android.graphics.Bitmap class illegally assumes that the size of the ashmem region provided by the user matches the actual underlying size of the Bitmap.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-11 CVE Reserved
- 2016-11-25 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/94164 | Third Party Advisory | |
| https://bugs.chromium.org/p/project-zero/issues/detail?id=928 | Third Party Advisory | |
| https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/40874 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://source.android.com/security/bulletin/2016-11-01.html | 2019-03-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | >= 6.0 <= 6.0.1 Search vendor "Google" for product "Android" and version " >= 6.0 <= 6.0.1" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 7.0 Search vendor "Google" for product "Android" and version "7.0" | - |
Affected
| ||||||