CVE-2015-8889
HighSummary
The aboot implementation in Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which may lead to unspecified impacts and attack vectors.
Risk Assessment
The absence of a recovery PIN feature may allow unauthorized access to the device, posing a risk to user data.
Recommendation
It is recommended to update the Android system to a version after 2016-07-05 to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Qualcomm components in Android
See all- CVE-2016-3855High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability that does not validate a certain count parameter. This allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application.
- CVE-2016-3854High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability in msm_mctl_buf.c that does not validate the image mode. This can lead to denial of service (out-of-bounds array access) or other unspecified impacts via a crafted application.
- CVE-2015-8943High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, there is no verification of mapping existence before proceeding with an unmap operation. This allows attackers to gain privileges via a crafted application.
- CVE-2015-8942High
In Qualcomm components in Android before 2016-08-05 on Nexus 6 devices, the stream state is not validated in msm_cpp.c, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8941High
The Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices have an issue with improper validation of array indexes, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8940High
Integer overflow in q6lsm.c in Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application.
- CVE-2015-8937High
In Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices, a bug in socket process handling allows attackers to gain privileges via a crafted application.
- CVE-2014-9891High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, certain buffer addresses are not validated, allowing attackers to gain privileges via a crafted application that makes an ioctl call.
- CVE-2014-9890High
Off-by-one error in Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application that sends an I2C command.
- CVE-2014-9889High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, CPP frame messages are not validated, allowing attackers to gain privileges via a crafted application.
Original NVD description (English source)
The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067.