Vulnerability Description
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check, such as msm_pcm_volume_ctl_put(), which means this freed memory could be used.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Android | - |
Related Weaknesses (CWE)
References
- https://source.android.com/security/bulletin/2017-07-01Vendor Advisory
- https://www.codeaurora.org/use-after-free-alsa-pcm-playback-kernel-module-cve-20Broken Link
- https://source.android.com/security/bulletin/2017-07-01Vendor Advisory
- https://www.codeaurora.org/use-after-free-alsa-pcm-playback-kernel-module-cve-20Broken Link
FAQ
What is CVE-2017-8246?
CVE-2017-8246 is a vulnerability with a CVSS score of 7.8 (HIGH). In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized an...
How severe is CVE-2017-8246?
CVE-2017-8246 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-8246?
Check the references section above for vendor advisories and patch information. Affected products include: Google Android.