SB2016031212 - Information disclosure in Google, Google Android
Published: March 12, 2016 Updated: August 9, 2020
Security Bulletin ID
SB2016031212
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2016-0823)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.
Remediation
Install update from vendor's website.
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
- http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
- http://source.android.com/security/bulletin/2016-03-01.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3
- http://www.securityfocus.com/bid/84265
- https://github.com/torvalds/linux/commit/ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce