CVE-2015-8890
HighSummary
In Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices, certain GUID Partition Table (GPT) data is not validated. This allows attackers to bypass intended access restrictions via a crafted MultiMediaCard (MMC).
Risk Assessment
Attackers may gain unauthorized access to the system, potentially leading to serious data security breaches.
Recommendation
It is recommended to update devices to the latest version of Android to mitigate this vulnerability.
Other vulnerabilities in Qualcomm components in Android
See all- CVE-2016-3855High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability that does not validate a certain count parameter. This allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application.
- CVE-2016-3854High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability in msm_mctl_buf.c that does not validate the image mode. This can lead to denial of service (out-of-bounds array access) or other unspecified impacts via a crafted application.
- CVE-2015-8943High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, there is no verification of mapping existence before proceeding with an unmap operation. This allows attackers to gain privileges via a crafted application.
- CVE-2015-8942High
In Qualcomm components in Android before 2016-08-05 on Nexus 6 devices, the stream state is not validated in msm_cpp.c, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8941High
The Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices have an issue with improper validation of array indexes, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8940High
Integer overflow in q6lsm.c in Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application.
- CVE-2015-8937High
In Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices, a bug in socket process handling allows attackers to gain privileges via a crafted application.
- CVE-2014-9891High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, certain buffer addresses are not validated, allowing attackers to gain privileges via a crafted application that makes an ioctl call.
- CVE-2014-9890High
Off-by-one error in Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application that sends an I2C command.
- CVE-2014-9889High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, CPP frame messages are not validated, allowing attackers to gain privileges via a crafted application.
Original NVD description (English source)
platform/msm_shared/partition_parser.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate certain GUID Partition Table (GPT) data, which allows attackers to bypass intended access restrictions via a crafted MultiMediaCard (MMC), aka Android internal bug 28822878 and Qualcomm internal bug CR823461.