Repost : 900 m Android devices affected by Qualcomm Vulnerability & 6P - Nexus 6P General

http://telecoms.com/474649/nearly-1-billion-android-devices-infected-with-qualcomm-vulnerability-exploit/
Four new vulnerability exploits have been found on over 900 million Android smartphones, with Qualcomm chipsets found to be the root cause, according to research by Check Point.
Researchers from security experts Check Point detected the vulnerabilities affecting all Android devices running a specificQualcomm
chipset. Since the vulnerabilities are found in the software drivers Qualcomm ships with its chipsets, and since said drivers are pre-installed on devices straight out of the factory, they can only be fixed by installing a patch from the distributor or operator. First, Qualcomm will need to provide the fixed driver pack to the operator before it can then distribute it to customers affected.
According to Check Point, the vulnerabilities, known as QuadRooter, can give attackers complete control of devices and unrestricted access to sensitive personal and enterprise data which may be stored on the device. Check Point presented the results of its research at hacking and information security conference Defcon.
“Following recent security issues discovered in Android, Google made a number of changes to tighten security across its fragmented landscape,” said Adam Donenfeld, Senior Security Researcher, Check Point “However, Google is not alone in the struggle to keep Android safe. Qualcomm, a supplier of 80% of the chipsets in the Android ecosystem, has almost as much effect on Android’s security as Google. With this in mind, we decided to examine Qualcomm’s code in Android devices. During our research, we found multiple privilege escalation vulnerabilities in multiple subsystems introduced byQualcomm
to all its Android devices in multiple different subsystems. In this presentation we will review not only the privilege escalation vulnerabilities we found, but also demonstrate and present a detailed exploitation, overcoming all the existing mitigations in Android’s Linux kernel to run kernel-code, elevating privileges and thus gaining root privileges and completely bypassing SELinux.”
Cloud security firm CensorNet said the exploit presents a clear and present danger for organisations using affected devices as part of a BYOD strategy.
“Give that BYOD is now commonplace, a vulnerability in mobile hardware on this scale could be a huge risk to enterprises,” said Ed Macnair, CEO of CensorNet. “By having root access to the primary device that many people use on a daily basis for business operations, a hacker basically becomes a superuser. Having unfettered access to company systems is a few relatively simple steps away.”
Check Point also revealed which devices are most affected by, or exposed to, the vulnerabilities. Some of the latest and most popular Android devices on the market use the affected Qualcomm chipsets, and they include:
• BlackBerry Priv
• Blackphone 1 and Blackphone 2
• Google Nexus 5X, Nexus 6 and Nexus 6P
• HTC One, HTC M9 and HTC 10
• LG G4, LG G5, and LG V10
• New Moto X by Motorola
• OnePlus One, OnePlus 2 and OnePlus 3
• Samsung Galaxy S7 and Samsung S7 Edge
• Sony Xperia Z Ultra
Users who fears they may be affected can scan for exploits using the application found here: https://play.google.com/store/apps/details?id=com.checkpoint.quadrooter. Telecoms.com reached out to Qualcomm for comment but is yet to hear a response at the time of writing.
UPDATE: 08/08/2016 17:22 BST – Qualcomm responded to Telecoms.com’s request for comment with the following:
“Providing technologies that support robust security and privacy is a priority for Qualcomm Technologies, Inc. (QTI). We were notified by the researcher about these vulnerabilities between February and April of this year, and made patches available for all four vulnerabilities to customers, partners, and the open source community between April and July. The patches were also posted on CodeAurora. QTI continues to work proactively both internally as well as with security researchers to identify and address potential security vulnerabilities.”

---

Just checked my Nexus 6P (bought 2 weeks ago) and it indeed has the vulnerability, as found by
the Checkpoint (zonealarm company) scanner,
CVE-2016-5340
https://play.google.com/store/apps/details?id=com.checkpoint.quadrooter

---

charlestek said:
Just checked my Nexus 6P (bought 2 weeks ago) and it indeed has the vulnerability, as found by
the Checkpoint (zonealarm company) scanner,
CVE-2016-5340
https://play.google.com/store/apps/details?id=com.checkpoint.quadrooter
Click to expand...
Click to collapse
I just received the August security update (MTC20F) and can confirm that it's still vulnerable.
Sent from my Nexus 6P using Tapatalk

---

daewond3r said:
I just received the August security update (MTC20F) and can confirm that it's still vulnerable.
Sent from my Nexus 6P using Tapatalk
Click to expand...
Click to collapse
How do you interrogate a listing of the phone OTA updates???

---

daewond3r said:
I just received the August security update (MTC20F) and can confirm that it's still vulnerable.
Click to expand...
Click to collapse
Yeah i just came here to ***** after flashing mine and running a check.
Honestly how can they release the august update, and fix only one of the two cve's that effect the 6p, when a patch already exists to fix for both (i know there was two previously as i ran the check before flashing), are we to believe that for their flag ship phone they could not have held onto the patch back 1 more day to include the fixed code.
Now we all have a month to go on an unpatched device. Seriously i moved to a nexus device so i wouldn't have to flash third party roms to get security patches.
Its not as if Qualcomm wasnt notified of this before public disclosure and already dished out patches. Its not as if they didnt have time by all account they have been sitting on the code since at least July, why only patch one of the two cve's that effected last months rom.... shakes head, not cool.
---------- Post added at 10:58 PM ---------- Previous post was at 10:57 PM ----------
charlestek said:
How do you interrogate a listing of the phone OTA updates???
Click to expand...
Click to collapse
I download and flash with fastboot

---

Is it that big of a deal? It looks like 3 of the 4 vulnerabilities were patched already.
I guess if you really want to be safe, just don't install any apps or updates before the September patch.

---

charlestek said:
How do you interrogate a listing of the phone OTA updates???
Click to expand...
Click to collapse
Not sure what you mean by interrogate. If you mean how do I know if it's still vulnerable, I used the app in the first post to check after I installed the security update.
Sent from my Nexus 6P using Tapatalk

---

daewond3r said:
Not sure what you mean by interrogate. If you mean how do I know if it's still vulnerable, I used the app in the first post to check after I installed the security update.
Sent from my Nexus 6P using Tapatalk
Click to expand...
Click to collapse
No, I meant, how do you query the device to tell what patches have been applied? I did look up that you can see the last patch number as well as the version number of the OS in settings.
I didn't know that you could see the last patch number before looking at it today.

---

plazma247 said:
Yeah i just came here to ***** after flashing mine and running a check.
Honestly how can they release the august update, and fix only one of the two cve's that effect the 6p, when a patch already exists to fix for both (i know there was two previously as i ran the check before flashing), are we to believe that for their flag ship phone they could not have held onto the patch back 1 more day to include the fixed code.
Now we all have a month to go on an unpatched device. Seriously i moved to a nexus device so i wouldn't have to flash third party roms to get security patches.
Its not as if Qualcomm wasnt notified of this before public disclosure and already dished out patches. Its not as if they didnt have time by all account they have been sitting on the code since at least July, why only patch one of the two cve's that effected last months rom.... shakes head, not cool.
---------- Post added at 10:58 PM ---------- Previous post was at 10:57 PM ----------
I download and flash with fastboot
Click to expand...
Click to collapse
Well, I am also on the Aug security patch and my phone reports two vulnerabilities 2504 and 5340.

---

logic88 said:
Is it that big of a deal? It looks like 3 of the 4 vulnerabilities were patched already.
I guess if you really want to be safe, just don't install any apps or updates before the September patch.
Click to expand...
Click to collapse
I don't have any nexus phone experience before two weeks ago, but can't Google release a patch or update out of band instead of on the normal monthly date???

---

For every vírus, exists the creator ... Who tell me if check point is not the big interested on this?? I Will not install they app to verify
Enviado do meu Nexus 6P através de Tapatalk

---

r3ix said:
For every vírus, exists the creator ... Who tell me if check point is not the big interested on this?? I Will not install they app to verify
Enviado do meu Nexus 6P através de Tapatalk
Click to expand...
Click to collapse
Supposedly the checkpoint security app (not the app that checks for vulnerabilities) does not work well.
However, please get a clue about security vulnerabilities, see here: https://source.android.com/security/bulletin/2016-08-01.html
and the CVE listings on Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5340
CVE-2016-5340
Description
The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://source.codeaurora.org/quic/.../?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6
CONFIRM:https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340
Date Entry Created
20160609 Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.

---

My 6P does have the CVE-2016-5340 vulnérability... How are they going to patch it ? What can i do ? What can't i do ?
Can i continu using my phone normally ?
Are the patch installing by themself or are they OTA update ?
Envoyé de mon Nexus 6P en utilisant Tapatalk

---

This article states that Google verify apps should block it's install
http://goo.gl/2Vs1wo
Google has confirmed that its Verify Apps security feature, which is enabled by default, will block the new Quadrooter Android exploit.

---

charlestek said:
I don't have any nexus phone experience before two weeks ago, but can't Google release a patch or update out of band instead of on the normal monthly date???
Click to expand...
Click to collapse
They could do that but they won't. Unless 7.0 is released this month, I don't see an update until the September security update is released.
Sent from my Nexus 5X using Tapatalk

---

SlimSnoopOS said:
They could do that but they won't. Unless 7.0 is released this month, I don't see an update until the September security update is released.
Sent from my Nexus 5X using Tapatalk
Click to expand...
Click to collapse
So you're telling me if there was some massive new threat that could compromise most android phones, they would sit and wait a month just to be on the monthly schedule?

---

The Qualcomm Snapdragon is my favorite mobile SoC.:laugh:

---

Franco kernel

---

charlestek said:
So you're telling me if there was some massive new threat that could compromise most android phones, they would sit and wait a month just to be on the monthly schedule?
Click to expand...
Click to collapse
They already have waited since they were made aware of the issue in the Spring. From what I understand, one needs to install an app from outside of the Play Store to be exposed and they also need to enable Unknown Sources" and also disable Google's security setting for "Verify Apps."
Sent from my Nexus 5X using Tapatalk

---

Xewyph said:
My 6P does have the CVE-2016-5340 vulnérability... How are they going to patch it ? What can i do ? What can't i do ?
Can i continu using my phone normally ?
Are the patch installing by themself or are they OTA update ?
Envoyé de mon Nexus 6P en utilisant Tapatalk
Click to expand...
Click to collapse
Stop drinking too much espresso!!!