Android Security Bulletin March 2017: What you need to know

The hits keep coming for the Android platform. Previously, in the February 2017 Security Bulletin, there were eight vulnerabilities marked Critical. This month, that number jumps to an unheard of eleven Critical issues. Let's take a look at those Critical flaws that are detailed in the March 2017 Android Security bulletin.

Check your security release

Before we highlight what's included with the March 2017 Android Security Bulletin, it's always good to know what security release is installed on your device. Of the Android devices I use regularly, the Verizon-branded Nexus 6, running Android 7.0, finally caught up to the latest security bulletin (Figure A). However, my daily driver, a OnePlus 3, is still lagging with the December 2016 security update. Although the OnePlus 3 has been upgraded to Nougat, the security patch is still behind; my guess is the security patch update will not happen until the device is upgraded to 7.1.1.

Figure A

Critical Issues

Remote code execution vulnerability in OpenSSL & BoringSSL

There's nothing boring about BoringSSL, especially when it suffers from a critical vulnerability. In fact, both OpenSSL and BoringSSL have been found to contain issues. This particular remote code execution vulnerability could enable an attacker, using a malicious file, to cause memory corruption during file and data processing. Because of the possibility of remote code execution within the context of a privileged process, this vulnerability is marked as Critical.

Related bug: A-32096880

More about IT Security

Remote code execution vulnerability in Mediaserver

There's a certain comfort in knowing the Mediaserver will continue to return to the Security Bulletin — like a dear friend that never leaves. Yet another remote code execution vulnerability could enable the attacker, using a malicious file, to cause memory corruption during the processing of either a media file or media-related data. Because of the possibility of remote code execution within the context of the Mediaserver, this vulnerability has been rated as Critical.

Elevation of privilege vulnerability in recovery verifier

A new entry to the Critical scene, the recovery verifier has been found to contain an elevation of privilege vulnerability. This vulnerability could enable a locally installed, malicious application to execute arbitrary code within the context of the kernel. Because of the possibility of permanent device compromise (which could require the reflashing of the operating system), this issue is rated as Critical.

Related bug: A-31914369

Elevation of privilege vulnerability in MediaTek components

MediaTek components (including the M4U, sound, touchscreen, GPU, and Command Queue drivers) have been discovered to contain an elevation of privilege vulnerability. This flaw could enable a local, malicious application to execute arbitrary code within the context of the kernel. Because of the possibility of permanent device compromise (which could require reflashing the operating system), this vulnerability has been marked as Critical.

Related bugs: A-28429685, M-ALPS02710006, A-28430015, M-ALPS02708983, A-28430164, M-ALPS02710027, A-28449045, M-ALPS02710075, A-30074628, M-ALPS02829371, A-31822282, M-ALPS02992041, A-32276718, M-ALPS03006904

NOTE: The patch for the A* bugs is not publically available and can be found within the latest binary drivers for Nexus devices from the Google Developer site.

Elevation of privilege vulnerability in NVIDIA GPU driver

The NVIDIA GPU driver has been found to contain an elevation of privilege vulnerability. This flaw could enable a local malicious application to execute arbitrary code within the context of the kernel. Because of the possibility of permanent device compromise (which could require the reflashing of the operating system), this vulnerability has been marked as Critical.

Related bugs: A-31992762, N-CVE-2017-0337, A-33057977, N-CVE-2017-0338, A-33899363, N-CVE-2017-0333, A-34132950, N-CVE-2017-0306, A-33043375, N-CVE-2017-0335