CVE-2016-10456
📋 TL;DR
This vulnerability allows arbitrary command execution as root/system user on affected Qualcomm Snapdragon devices running Android. An attacker can execute commands up to 15 characters by providing an invalid interface name to the radish utility. Affects Android devices with Qualcomm chipsets before the April 2018 security patch.
💻 Affected Systems
- Qualcomm Snapdragon Mobile and Snapdragon Wear chipsets: MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SDX20
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise with root privileges, allowing installation of persistent malware, data theft, and complete system control.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive data and system resources.
If Mitigated
Limited impact if device is fully patched and has proper application sandboxing in place.
🎯 Exploit Status
Requires local access to device and ability to execute radish with malicious parameters. Could be exploited by malicious apps or users with shell access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android security patch level April 5, 2018 or later
Vendor Advisory: https://source.android.com/security/bulletin/2018-04-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in device settings. 2. Apply the April 2018 or later security patch. 3. Reboot device after update completes. 4. Verify patch level in Settings > About phone > Android security patch level.
🔧 Temporary Workarounds
Remove radish executable
androidRemove or restrict execution permissions for the radish binary if present on device
adb shell rm /system/bin/radish
adb shell chmod 000 /system/bin/radish
Restrict shell access
android🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement strict application whitelisting to prevent malicious app installation
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone. If date is before April 2018, device is vulnerable. Also check if radish binary exists: adb shell ls -la /system/bin/radishCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows April 2018 or later. Test radish execution with invalid interface name should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual radish process execution
- Failed radish commands with invalid interface names
- Unexpected system command execution from user processes
Network Indicators:
- None - local exploitation only
SIEM Query:
process_name:"radish" AND (command_line:"*invalid*" OR command_line:"*interface*" OR command_line_length<16)