CVE-2015-9179
📋 TL;DR
This is a critical buffer overflow vulnerability in Qualcomm's OEMCrypto implementation on Android devices. Attackers could execute arbitrary code with system privileges by exploiting the lack of length checking in OEMCrypto_DeriveKeysFromSessionKey(). Affects Android devices with Qualcomm Snapdragon MSM8974 chipsets before the April 2018 security patch.
💻 Affected Systems
- Android devices with Qualcomm Snapdragon MSM8974 chipset
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing remote code execution with system privileges, potentially enabling persistent malware installation, data theft, and device control.
Likely Case
Local privilege escalation allowing apps to gain system-level access, bypassing Android's sandbox protections and accessing sensitive data.
If Mitigated
No impact if patched; limited impact if device has additional security controls like SELinux strict mode and app sandboxing.
🎯 Exploit Status
Exploitation requires local access or malicious app installation; buffer overflow in cryptographic function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android security patch level 2018-04-05 or later
Vendor Advisory: https://source.android.com/security/bulletin/2018-04-01
Restart Required: Yes
Instructions:
1. Check device security patch level in Settings > About phone > Android security patch level. 2. If before April 2018, update via Settings > System > System update. 3. Install available updates and restart device.
🔧 Temporary Workarounds
Disable OEMCrypto usage
androidPrevent apps from using vulnerable OEMCrypto functions
🧯 If You Can't Patch
- Replace affected devices with updated hardware
- Implement strict app vetting and only install from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android security patch level. If date is before April 2018, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows April 2018 or later date after update.📡 Detection & Monitoring
Log Indicators:
- OEMCrypto_DeriveKeysFromSessionKey function calls with abnormal parameters
- SELinux denials related to OEMCrypto
Network Indicators:
- Unusual DRM/license server communications from vulnerable devices
SIEM Query:
android.security_patch_level < "2018-04-05" AND device_hardware LIKE "%MSM8974%"