Security Experts:

Connect with us

Hi, what are you looking for?



High Severity Flaw in Android Allows Arbitrary Code Execution

Trend Micro mobile threat response engineer Wish Wu has identified a new Android vulnerability caused by an issue in the mobile operating system’s mediaserver component. The flaw has been patched by Google.

Trend Micro mobile threat response engineer Wish Wu has identified a new Android vulnerability caused by an issue in the mobile operating system’s mediaserver component. The flaw has been patched by Google.

The vulnerability, a heap overflow in mediaserver’s Audio Policy Service (CVE-2015-3842), affects Android versions 2.3 through 5.1.1. The flaw allows a local application to execute arbitrary code with the privileges of the mediaserver process.

Several vulnerabilities have been identified recently in the mediaserver component. The list includes denial-of-service (DoS) flaws and the notorious Stagefright vulnerabilities, some of which allow remote attackers to easily take complete control of affected devices.

The latest mediaserver-related vulnerability whose details have been disclosed by Trend Micro involves a component called AudioEffect. The security bug can be exploited by getting the victim to install an app that doesn’t require any permissions. This malicious application can then execute arbitrary code.

“This attack can be fully controlled, which means a malicious app can decide when to start the attack and also when to stop. An attacker would be able to run their code with the same permissions that mediaserver already has as part of its normal routines. Since the mediaserver component deals with a lot of media-related tasks including taking pictures, reading MP4 files, and recording videos, the privacy of the victim may be at risk,” Wu explained in a blog post.

The flaw was reported to Google on June 19 and it was patched with the August 2015 security updates. Trend Micro says it’s not aware of active attacks leveraging this vulnerability.

“This issue is rated as a High severity due to the possibility of code execution as the privileged mediaserver service, from a local application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access,” Google said.

The search giant has pointed out that Wu is the first researcher to receive a reward as part of the Android Security Rewards program, which Google announced in June. According to the rules of the program, high severity vulnerabilities can earn bounty hunters up to $4,000. Since Wu also submitted a patch, he should have been awarded at least $2.000 for his findings.

Related Reading: Samsung to Deliver Monthly Over the Air Security Updates for Android

Related Reading: Google to Issue Over The Air Updates to Nexus Devices

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.