Nexus Security Bulletin - September 2015

We have released a security update to Nexus devices through an over-the-air (OTA) update as part of our Android Security Bulletin Monthly Release process (Build LMY48M). The updates for Nexus devices and source code patches for these issues have also been released to the Android Open Source Project (AOSP) source repository. The most severe of these issues is a Critical security vulnerability that could enable remote code execution on an affected device.

The Nexus firmware images have also been released to the Google Developer site. Builds LMY48M or later address these issues. Partners were notified about these issues on August 13, 2015 or earlier.

We have not detected customer exploitation of the newly reported issues. The exception is the existing issue (CVE-2015-3636). Refer to the Mitigations section for details on the Android security platform protections, and service protections such as SafetyNet, which reduce the likelihood that security vulnerabilities can be successfully exploited on Android.

Please note that both Critical security updates (CVE-2015-3864 and CVE-2015-3686) address already disclosed vulnerabilities. There are no newly disclosed Critical security vulnerabilities in this update. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.

We encourage all customers to accept these updates to their devices.

Mitigations

This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities can be successfully exploited on Android.

• Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
• The Android Security team is actively monitoring for abuse with Verify Apps and SafetyNet which will warn about potentially harmful applications about to be installed. Device rooting tools are prohibited within Google Play. To protect users who install applications from outside of Google Play, Verify Apps is enabled by default and will warn users about known rooting applications. Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove any such applications.
• As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as mediaserver.

Acknowledgements

We would like to thank these researchers for their contributions:

• Jordan Gruskovnjak of Exodus Intelligence (@jgrusko): CVE-2015-3864
• Michał Bednarski: CVE-2015-3845
• Guang Gong of Qihoo 360 Technology Co. Ltd (@oldfresher): CVE-2015-1528, CVE-2015-3849
• Brennan Lautner: CVE-2015-3863
• jgor (@indiecom): CVE-2015-3860
• Wish Wu of Trend Micro Inc. (@wish_wu): CVE-2015-3861

Security Vulnerability Details

In the sections below, we provide details for each of the security vulnerabilities in this bulletin. There is a description of the issue, a severity rationale, and a table with the CVE, associated bug, severity, affected versions, and date reported. Where available, we’ve linked the AOSP change that addressed the issue to the bug ID. When multiple changes relate to a single bug, additional AOSP references are linked to numbers following the bug ID.

Remote Code Execution Vulnerability in Mediaserver

During media file and data processing of a specially crafted file, vulnerabilities in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process.

The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

This issue is rated as a Critical severity due to the possibility of remote code execution within the context of the mediaserver service. The mediaserver service has access to audio and video streams as well as access to privileges that third-party apps cannot normally access.

This issue is related to the already reported CVE-2015-3824 (ANDROID-20923261). The original security update was not sufficient to address a variant of this originally reported issue.

CVE	Bug with AOSP links	Severity	Affected Versions
CVE-2015-3864	ANDROID-23034759	Critical	5.1 and below

Elevation Privilege Vulnerability in Kernel

An elevation of privilege vulnerability in the Linux kernel’s handling of ping sockets could allow a malicious application to execute arbitrary code in context of the kernel.

This issue is rated as a Critical severity due to the possibility of code execution in a privileged service that can bypass device protections, potentially leading to permanent compromise (i.e., requiring re-flashing the system partition) on some devices.

This issue was first publicly identified on May 01, 2015. An exploit of this vulnerability has been included in a number of “rooting” tools that may be used by the device owner to modify the firmware on their device.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3636	ANDROID-20770158	Critical	5.1 and below

Elevation of Privilege Vulnerability in Binder

An elevation of privilege vulnerability in Binder could allow a malicious application to execute arbitrary code within the context of the another app’s process.

This issue is rated as High severity because it allows a malicious application to gain privileges not accessible to a third-party application.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3845	ANDROID-17312693	High	5.1 and below
CVE-2015-1528	ANDROID-19334482 [2]	High	5.1 and below

Elevation of Privilege Vulnerability in Keystore

A elevation of privilege vulnerability in Keystore could allow a malicious application to execute arbitrary code within the context of the keystore service. This could allow unauthorized use of keys stored by Keystore, including hardware-backed keys.

This issue is rated as High severity because it can be used to gain privileges not accessible to a third-party application.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3863	ANDROID-22802399	High	5.1 and below

Elevation of Privilege Vulnerability in Region

An elevation of privilege vulnerability in Region could, through creation of a malicious message to a service, allow a malicious application to execute arbitrary code within the context of the target service.

This issue is rated as High severity because it can be used to gain privileges not accessible to a third-party application.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3849	ANDROID-20883006 [2]	High	5.1 and below

Elevation of Privilege vulnerability in SMS enables notification bypass

A elevation of privilege vulnerability in the way that Android processes SMS messages could enable a malicious application to send an SMS message that bypasses the premium-rate SMS warning notification.

This issue is rated as High severity because it can be used to gain privileges not accessible to a third-party application.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3858	ANDROID-22314646	High	5.1 and below

Elevation of Privilege Vulnerability in Lockscreen

An elevation of privilege vulnerability in Lockscreen could allow a malicious user to bypass the lockscreen by causing it to crash. This issue is classified as a vulnerability only on Android 5.0 and 5.1. While it’s possible to cause the System UI to crash from the lockscreen in a similar way on 4.4, the home screen cannot be accessed and the device must be rebooted to recover.

This issue is rated as a Moderate severity because it potentially allows someone with physical access to a device to install third-party apps without the device’s owner approving the permissions. It can also allow the attacker to view contact data, phone logs, SMS messages, and other data that is normally protected with a “dangerous” level permission.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3860	ANDROID-22214934	Moderate	5.1 and 5.0

Denial of Service Vulnerability in Mediaserver

A denial of service vulnerability in mediaserver could allow a local attacker to temporarily block access to an affected device.

This issue is rated as a Low severity because a user could reboot into safe mode to remove a malicious application that is exploiting this issue. It is also possible to cause mediaserver to process the malicious file remotely through the web or over MMS, in that case the mediaserver process crashes and the device remains usable.

CVE	Bug(s) with AOSP links	Severity	Affected Versions
CVE-2015-3861	ANDROID-21296336	Low	5.1 and below