CVE-2016-0823

Published on: 03/12/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:13 PM UTC

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Certain versions of Android from Google contain the following vulnerability:

The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.

  • CVE-2016-0823 has been assigned by [email protected] to track the vulnerability - currently rated as MEDIUM severity.

CVSS3 Score: 4 - MEDIUM

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
LOCAL LOW NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED LOW NONE NONE

CVSS2 Score: 2.1 - LOW

Access
Vector
Access
Complexity
Authentication
LOCAL LOW NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
PARTIAL NONE NONE

CVE References

Description Tags Link
Google Android CVE-2016-0823 Information Disclosure Vulnerability cve.report (archive)
text/html
URL Logo BID 84265
pagemap: do not leak physical addresses to non-privileged userspace · torvalds/[email protected] · GitHub github.com
text/html
URL Logo CONFIRM github.com/torvalds/linux/commit/ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
Nexus Security Bulletin - March 2016 | Android Open Source Project Vendor Advisory
source.android.com
text/html
URL Logo CONFIRM source.android.com/security/bulletin/2016-03-01.html
kernel/git/torvalds/linux.git - Linux kernel source tree git.kernel.org
text/html
URL Logo CONFIRM git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges googleprojectzero.blogspot.com
text/html
URL Logo MISC googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
www.kernel.org
text/plain
CONFIRM www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System
GoogleAndroid6.0.1AllAllAll
Operating
System
GoogleAndroid6.0.1AllAllAll
Operating
System
LinuxLinux KernelAllAllAllAll
  • cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*:
  • cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*:
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*: