Vulnerability Details : CVE-2016-8418
A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the context of the kernel. Product: Android. Versions: N/A. Android ID: A-32652894. References: QC-CR#1077457.
Published
2017-02-08 15:59:00
Updated
2017-07-25 01:29:03
Vulnerability category: Execute codeBypassGain privilege
Exploit prediction scoring system (EPSS) score for CVE-2016-8418
Probability of exploitation activity in the next 30 days: 0.62%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 76 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-8418
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-8418
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-8418
-
http://www.securitytracker.com/id/1037798
Google Android Multiple Flaws Let Users Deny Service, Obtain Potentially Sensitive Information, and Gain Elevated Privileges and Let Remote Users Execute Arbitrary Code - SecurityTracker
-
http://www.securityfocus.com/bid/96058
Google Nexus Qualcomm Crypto Driver CVE-2016-8418 Remote Code Execution VulnerabilityThird Party Advisory
-
https://source.android.com/security/bulletin/2017-02-01.html
Android Security Bulletin—February 2017 | Android Open Source ProjectVendor Advisory
Products affected by CVE-2016-8418
- cpe:2.3:o:google:android:*:*:*:*:*:*:*:*