Trend Micro mobile threat response engineer Wish Wu has identified a new Android vulnerability caused by an issue in the mobile operating system’s mediaserver component. The flaw has been patched by Google.
The vulnerability, a heap overflow in mediaserver’s Audio Policy Service (CVE-2015-3842), affects Android versions 2.3 through 5.1.1. The flaw allows a local application to execute arbitrary code with the privileges of the mediaserver process.
Several vulnerabilities have been identified recently in the mediaserver component. The list includes denial-of-service (DoS) flaws and the notorious Stagefright vulnerabilities, some of which allow remote attackers to easily take complete control of affected devices.
The latest mediaserver-related vulnerability whose details have been disclosed by Trend Micro involves a component called AudioEffect. The security bug can be exploited by getting the victim to install an app that doesn’t require any permissions. This malicious application can then execute arbitrary code.
“This attack can be fully controlled, which means a malicious app can decide when to start the attack and also when to stop. An attacker would be able to run their code with the same permissions that mediaserver already has as part of its normal routines. Since the mediaserver component deals with a lot of media-related tasks including taking pictures, reading MP4 files, and recording videos, the privacy of the victim may be at risk,” Wu explained in a blog post.
The flaw was reported to Google on June 19 and it was patched with the August 2015 security updates. Trend Micro says it’s not aware of active attacks leveraging this vulnerability.
“This issue is rated as a High severity due to the possibility of code execution as the privileged mediaserver service, from a local application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access,” Google said.
The search giant has pointed out that Wu is the first researcher to receive a reward as part of the Android Security Rewards program, which Google announced in June. According to the rules of the program, high severity vulnerabilities can earn bounty hunters up to $4,000. Since Wu also submitted a patch, he should have been awarded at least $2.000 for his findings.
Related Reading: Samsung to Deliver Monthly Over the Air Security Updates for Android
Related Reading: Google to Issue Over The Air Updates to Nexus Devices