The Quadrooter vulnerabilities which got everyone’s attention due to it’s high impact scale of more than 900,000 Android devices. This vulnerability is on par with other huge vulnerabilities like StageFright.
Details on about four vulnerabilities were publicly disclosed back in August this year during DEF CON by the researchers at Check Point Software Technologies. They warned that popular handsets made by Motorola, Samsung and others were affected, and put them at high risk to complete compromise.
Two of these four vulnerabilities were patched in July and August itself, and today, Google patched the rest in its monthly Android Security updates. The latest patches were pushed out today to the Nexus devices in an over-the-air update, while others will be given the updates soon. The Android Open Source Project will receive these patches within 48 hours of their release.
These vulnerabilities enable privilege escalation and thus open the door to remote attacks. Many subsystems of the Qualcomm chipset are affected and these vulnerabilities can be exploited to bypassing existing mitigations in the Android Linux kernel, allowing an attacker to gain the root privileges, Check Point said.
The most easiest way to compromise an Android device that is vulnerable to Quadrooter would be to trick the user into downloading a malicious app. There are flaws in Qualcomm drivers which control communication between different components in the chip. Today Google patched CVE-2016-2059 and CVE-2016-5340. CVE-2016-5340 is a bug in the Android’s memory allocation subsystem that is called ashmem, while CVE-2016-2059 is in the Linux inter-process communication router module.
These two flaws allow for root access and all it takes to have a successful exploit would be a re-flashed device, Google said. The previously patched bugs, CVE-2016-2503 (July) and CVE-2016-2504 (August), addressed use-after-free flaws tied to race conditions in the kernel graphics support layer, a Qualcomm GPU component.