[Japanese]

JVNDB-2014-000137

Multiple improper data validation vulnerabilities in Syslink driver for Texas Instruments OMAP mobile processors

Overview

The Syslink driver for OMAP mobile processors contained in Android devices contain mulitple improper data validation vulerabilities.

The OMAP mobile processor provided by Texas Instruments is used in some Android tablets, smartphones and other devices. The Syslink driver for some OMAP mobile processors is used to implement the communication of processes between the host and slave processors.
The Syslink driver contains multiple vulnerabilities where userland data is not properly validated prior to use. Exploitation of these vulnerabilities may lead to arbitrary code execution or kernel memory content disclosure.

Masaaki Chida of GREE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

Base Metrics: 6.2 (Medium) [IPA Score]
  • Access Vector: Local
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Complete
  • Integrity Impact: Complete
  • Availability Impact: Complete

Affected Products

Multiple products are affected. For more information, refer to the information provided by the developer or provider.

(Multiple Venders)
  • (Multiple Products)

Impact

When the device is accessed through the Android Debug Bridge (adb), contents of the kernel memory may be obtained or arbitrary code may be executed to obtain root privileges.
Solution

[Apply an Update]
Apply the appropriate update according to the information provided by the developer or provider.
Vendor Information

SoftBank NTT DOCOMO, INC.
CWE (What is CWE?)

  1. Improper Input Validation(CWE-20) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2014-7252
References

  1. JVN : JVN#67792023
  2. National Vulnerability Database (NVD) : CVE-2014-7252
Revision History

[2014/12/02]
  Web page was published
[2014/12/09]
  References : Content was added