FireEye has disclosed the details of a serious information disclosure vulnerability affecting a Qualcomm software package found in hundreds of Android device models.
Google announced this week that it released an Android update to patch tens of vulnerabilities. The search giant’s security advisory also mentioned an information disclosure vulnerability in the Qualcomm tethering controller (CVE-2016-2060) that allows a malicious application to access user information.
The vulnerability, discovered by researchers at FireEye-owned Mandiant, has been rated “high severity,” but Google noted that it does not affect Nexus devices. The patch for the issue is not in the Android Open Source Project (AOSP) repository — instead, it should be included in the latest driver updates for affected devices.
FireEye said its researchers informed Qualcomm about the vulnerability in January and the vendor developed a fix by early March, when it started reaching out to OEMs to let them know about the issue. Now it’s up to the device manufacturers to push out the patch to customers.
The flaw exists in an open source software package maintained by Qualcomm and is related to the Android network daemon (netd).
“The vulnerability was introduced when Qualcomm provided new APIs as part of the ‘network_manager’ system service, and subsequently the ‘netd’ daemon, that allow additional tethering capabilities, possibly among other things,” FireEye said.
The flaw has been confirmed to affect devices running Android 5.0 Lollipop and earlier, which currently account for roughly three-quarters of Android devices. Researchers noted that the affected Qualcomm software package is used in a variety of projects, including the popular CyanogenMod, and the vulnerable APIs appear to have been around since at least 2011.
The vulnerability can be exploited to escalate privileges to the built-in “radio” user, which has permissions that are normally not available to a third-party app. The most efficient way to exploit CVE-2016-2060 is via a malicious application that is granted the “ACCESS_NETWORK_STATE” permission. According to experts, any app can interact with the vulnerable API without raising any suspicion and it’s unlikely that Google Play would flag such an Android app as being malicious.
However, experts noted that the vulnerability has limited impact on devices running Android 4.4 and later, which include significant security enhancements.
“On older devices, the malicious application can extract the SMS database and phone call database, access the Internet, and perform any other capabilities allowed by the ‘radio’ user,” FireEye said. “Newer devices are affected less. The malicious application can modify additional system properties maintained by the operating system. The impact here depends entirely on how the OEM is using the system property subsystem.”
Qualcomm has issued its own advisory for CVE-2016-2060 and provided SecurityWeek the following statement:
“Enabling robust security and privacy is a top priority for Qualcomm Technologies, Inc. Recently, we worked with Mandiant, a FireEye company, to address the vulnerability (CVE-2016-2060) that may affect Android-based devices powered by certain Snapdragon processors. We are not aware of any exploitation of this vulnerability. We have made security updates available to our customers to address this vulnerability.”
*Updated with statement and advisory from Qualcomm
Related: Android Ransomware Dropped via Towelroot, Hacking Team Exploits