CVE-2017-0553 Integer overflow in Android
High 7.0
Published
Updated
Check this codebase for CVE-2017-0553 and fix it if it is affected.
What it is: CVE-2017-0553 is a high-severity vulnerability in Google Android, published on 7 Apr 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2017-0553 in the wild and no public exploit code.
Affected product: Google Android. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/CVE-2017-0553/ (Markdown: https://insights.sbomify.com/CVE-2017-0553/index.md)
A local attacker can exploit an integer overflow in libnl to execute arbitrary code with Wi-Fi service privileges on Android devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-0553?
CVE-2017-0553 is a high-severity vulnerability in Google Android, published on 7 Apr 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library.
Weakness: CWE-190
Which versions are affected by CVE-2017-0553?
It affects 1 product.
Linux distribution packages (40)
NetworkManager Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-adsl Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-bluetooth Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-config-server Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-debuginfo Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-dispatcher-routing-rules Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-glib Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-glib-devel Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-libnm Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-libnm-devel Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-libreswan Red Hat:enterprise_linux:7::client | All versions | 0:1.2.4-2.el7 |
NetworkManager-libreswan-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.2.4-2.el7 |
NetworkManager-libreswan-gnome Red Hat:enterprise_linux:7::client | All versions | 0:1.2.4-2.el7 |
NetworkManager-ppp Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-team Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-tui Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-wifi Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
NetworkManager-wwan Red Hat:enterprise_linux:7::client | All versions | 1:1.8.0-9.el7 |
libnl3 Red Hat:enterprise_linux:7::client | All versions | 0:3.2.28-4.el7 |
libnl3-cli Red Hat:enterprise_linux:7::client | All versions | 0:3.2.28-4.el7 |
libnl3-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:3.2.28-4.el7 |
libnl3-devel Red Hat:enterprise_linux:7::client | All versions | 0:3.2.28-4.el7 |
libnl3-doc Red Hat:enterprise_linux:7::client | All versions | 0:3.2.28-4.el7 |
libnm-gtk Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
libnm-gtk-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
libnma Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
libnma-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
network-manager-applet Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
network-manager-applet-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
nm-connection-editor Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-3.el7 |
NetworkManager Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-adsl Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-bluetooth Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-config-server Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-dispatcher-routing-rules Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-glib Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-glib-devel Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-libnm Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
NetworkManager-libnm-devel Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.0-9.el7 |
Products include Google Android.
How do I fix CVE-2017-0553?
Apply the vendor's patch.
Is CVE-2017-0553 being exploited?
There is no known exploitation of CVE-2017-0553 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as DEBIAN-CVE-2017-0553, DLA-891-1, DLA-892-1, GHSA-697f-p26c-wf65, RHSA-2017:2299, UBUNTU-CVE-2017-0553 and 1 more.