CVE-2016-8405

Description

An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31651010.

CVSS Metrics

• v3.0•MEDIUM•Score: 4.7CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.34%• Percentile: 57%

Techniques & Countermeasures

• CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

• google inc.•android

  Kernel-3.10 | Kernel-3.18

• linux•linux_kernel

  3.10 | 3.18

References (3)

• https://source.android.com/security/bulletin/2016-12-01.html
• http://www.securityfocus.com/bid/94686
• http://www.debian.org/security/2017/dsa-3791