CVE-2017-0448

An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-32721029. References: N-CVE-2017-0448.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/96105	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037798
https://source.android.com/security/bulletin/2017-02-01.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android::::::::
	cpe:2.3:o:linux:linux_kernel:3.10:::::::*

History

No history.

Information

Published : 2017-02-08 15:59

Updated : 2024-02-04 19:11

NVD link : CVE-2017-0448

Mitre link : CVE-2017-0448

CVE.ORG link : CVE-2017-0448

JSON object : View

Products Affected

google

android

linux

linux_kernel

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2017-0448", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2017-02-08T15:59:01.957", "references": [{"url": "http://www.securityfocus.com/bid/96105", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@android.com"}, {"url": "http://www.securitytracker.com/id/1037798", "source": "security@android.com"}, {"url": "https://source.android.com/security/bulletin/2017-02-01.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@android.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-32721029. References: N-CVE-2017-0448."}, {"lang": "es", "value": "Una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el controlador de v\u00eddeo NVIDIA podr\u00eda habilitar a una aplicaci\u00f3n local maliciosa acceder a datos fuera de sus niveles de permiso. Este problema est\u00e1 clasificado como High porque podr\u00eda ser utilizado para acceso a datos sensibles sin permisos de usuario expl\u00edcitos. Producto: Android. Versiones: Kernel-3.10. Android ID: A-32721029. Referencias: N-CVE-2017-0448."}], "lastModified": "2017-07-25T01:29:06.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F11609D-D1B4-4DD6-8CC7-A224344E1E67", "versionEndIncluding": "7.1.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C37F47C-C217-4BCF-A758-14E1BDBAD63D"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}