Google Patches Android Mediaserver Flaw

Wednesday, August 19, 2015 @ 12:08 PM gHale

Google patched a new Android vulnerability which was from a problem in the mobile operating system’s mediaserver component.

The vulnerability, a heap overflow in mediaserver’s Audio Policy Service (CVE-2015-3842), affects Android versions 2.3 through 5.1.1, according to Trend Micro mobile threat response engineer Wish Wu, who discovered the flaw.

Android Stagefright Flaw Fixed, Again
Another Android Security Flaw
Android Phones Open to Attack
Android Devices Vulnerable to Memory Hole

The problem allows a local application to execute arbitrary code with the privileges of the mediaserver process.

Android has had vulnerabilities identified of late in the mediaserver component. The list includes denial-of-service (DoS) flaws and Stagefright vulnerabilities, some of which allow remote attackers to take complete control of affected devices.

The latest mediaserver-related vulnerability disclosed by Trend Micro involves the AudioEffect component. The problem can undergo exploitation by getting the victim to install an app that doesn’t require any permissions. This malicious application can then execute arbitrary code.

“This attack can be fully controlled, which means a malicious app can decide when to start the attack and also when to stop. An attacker would be able to run their code with the same permissions that mediaserver already has as part of its normal routines. Since the mediaserver component deals with a lot of media-related tasks including taking pictures, reading MP4 files, and recording videos, the privacy of the victim may be at risk,” Wu said in a blog post.

The flaw ended up reported to Google June 19 and the search giant patched it with the August 2015 security updates.

Trend Micro said it is not aware of active attacks leveraging this vulnerability.

“This issue is rated as a High severity due to the possibility of code execution as the privileged mediaserver service, from a local application. While mediaserver is guarded with SELinux, it does have access to audio and video streams as well as access to privileged kernel driver device nodes on many devices that 3rd party apps cannot normally access,” Google said.

Google said Wu is the first researcher to receive a reward as part of the Android Security Rewards program, which Google announced in June. According to the rules of the program, high severity vulnerabilities can earn bounty hunters up to $4,000. Since Wu also submitted a patch, he should have gained at least $2,000 for his findings.