CVE-2016-3890

Severity

76%

Complexity

49%

Confidentiality

165%

The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.

CVSS 3.0 Base Score 7. CVSS Attack Vector: local. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.6. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C).

Overview

Type

Google Android

First reported 8 years ago

2016-09-11 21:59:00

Last updated 7 years ago

2017-08-13 01:29:00

Affected Software

Google Android Operating System 4.0

4.0

Google Android Operating System 4.0.1

4.0.1

Google Android Operating System 4.0.2

4.0.2

Google Android Operating System 4.0.3

4.0.3

Google Android Operating System 4.0.4

4.0.4

Google Android Operating System 4.1

4.1

Google Android Operating System 4.1.2

4.1.2

Google Android Operating System 4.2 (Jelly Bean)

4.2

Google Android Operating System 4.2.1

4.2.1

Google Android Operating System 4.2.2

4.2.2

Google Android Operating System 4.3

4.3

Google Android Operating System 4.3.1

4.3.1

Google Android Operating System 4.4

4.4

Google Android Operating System 4.4.1

4.4.1

Google Android Operating System 4.4.2

4.4.2

Google Android Operating System 4.4.3

4.4.3

Google Android Operating System 5.0

5.0

Google Android 5.0.1

5.0.1

Google Android 5.1

5.1

Google Android 5.1.0

5.1.0

Google Android 6.0

6.0

Google Android 6.0.1

6.0.1

References

http://source.android.com/security/bulletin/2016-09-01.html

Vendor Advisory

92851

1036763

https://android.googlesource.com/platform/system/core/+/014b01706cc64dc9c2ad94a96f62e07c058d0b5d

Issue Tracking, Patch

https://android.googlesource.com/platform/system/core/+/268068f25673242d1d5130d96202d3288c91b700