oss-security - CVE Request - Samsung Exynos fimg2d Multiple Issues

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACCOJE2A=1ruGLYkTe5n=nUKRJo6jaLH_-Q6e=F2vHFiUQg=vg@mail.gmail.com>
Date: Wed, 9 Nov 2016 15:41:47 +0800
From: Idler <idler1984@...il.com>
To: oss-security@...ts.openwall.com, Anarcheuz Fritz <anarcheuz@...il.com>, 
	cve-assign@...re.org
Subject: CVE Request - Samsung Exynos fimg2d Multiple Issues

Hello,

I'd like to request for CVEs for the following two vulnearbilities
fixed in Samsung Exynos fimg2d driver for Android:

Security bulletin: http://security.samsungmobile.com/smrupdate.html#SMR-NOV-2016

SVE-2016-6736: Kernel Crash on /dev/fimg2d ioctl command
Severity: Medium
Affected versions: All devices with Exynos 5433/54xx/7420 chipsets
Reported on: June 11, 2016
Disclosure status: Privately disclosed.
The fimg2d which is one of the graphic devices for Exynos chipsets
doesn’t have exception control routines to handle unexpected commands
and it can lead to kernel panic.
The patch prevents kernel panic by ignoring inappropriate commands at the state.

SVE-2016-6853: Use After Free in /dev/fimg2d
Severity: Medium
Affected versions: All devices with Exynos 5433/54xx/7420 chipsets
Reported on: August 5, 2016
Disclosure status: Privately disclosed.
A use-after-free vulnerability in fimg2d allows attackers to gain
access to unauthorized data.
The patch with error handling was applied.

Thank you,
James

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.