CVE-2017-15851 Information disclosure in Android for MSM, Firefox OS for MSM, QRD Android

High 7.8 Published 6 Jul 2018 Updated 17 Sep 2024

A missing copy_from_user check in the Qualcomm OIS driver allows attackers to leak kernel memory and crash the camera subsystem on Android devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-15851?

CVE-2017-15851 is a high-severity vulnerability in Google Android, published on 6 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera crash in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel

Weakness: CWE-200

Which versions are affected by CVE-2017-15851?

It affects 1 product.

Products include Google Android.

How do I fix CVE-2017-15851?

No fix has been published for CVE-2017-15851 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-15851 being exploited?

There is no known exploitation of CVE-2017-15851 in the wild and no public exploit code.

All Google Android vulnerabilities

Sources

Also known as GHSA-w696-hqwm-q32v.