CVE-2016-6604
📋 TL;DR
A NULL pointer dereference vulnerability in Samsung's fimg2d graphics driver for Android allows attackers to potentially crash devices or execute arbitrary code. This affects Samsung devices running Android 5.0/5.1 (Lollipop) and 6.0 (Marshmallow) with Exynos processors. The vulnerability could be exploited through malicious applications or other vectors.
💻 Affected Systems
- Samsung smartphones and tablets with Exynos processors
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or persistent malware installation.
Likely Case
Device crash/reboot (kernel panic) or local privilege escalation to kernel level.
If Mitigated
Limited impact if device is patched, has SELinux restrictions, and runs only trusted applications.
🎯 Exploit Status
Exploitation requires kernel-level knowledge and driver interaction. No public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August 2016 security update (SMR-AUG-2016)
Vendor Advisory: http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > About phone > Software update. 2. Install August 2016 or later security patch. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable unnecessary applications
androidReduce attack surface by disabling or uninstalling unused apps that could be vectors.
Enable Google Play Protect
androidUse built-in malware scanning to detect potentially malicious applications.
🧯 If You Can't Patch
- Replace device with supported model receiving security updates
- Isolate device from sensitive networks and data
🔍 How to Verify
Check if Vulnerable:
Check Android version (Settings > About phone) and security patch level. If running Android 5.0-6.0 with patch level before August 2016, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows August 2016 or later in Settings > About phone > Android security patch level.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- fimg2d driver crash messages in dmesg
- Unexpected process termination
Network Indicators:
- Unusual network activity from device after suspected exploitation
SIEM Query:
Device logs showing kernel crashes or unexpected reboots on Android 5.0-6.0 devices🔗 References
- http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016
- http://www.openwall.com/lists/oss-security/2016/08/05/3
- http://www.openwall.com/lists/oss-security/2016/08/18/10
- http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016
- http://www.openwall.com/lists/oss-security/2016/08/05/3
- http://www.openwall.com/lists/oss-security/2016/08/18/10
