CVE-2017-17773
📋 TL;DR
A buffer overflow vulnerability in Qualcomm Snapdragon chipsets allows attackers to execute arbitrary code by sending specially crafted video files. This affects millions of automotive, wearable, and mobile devices using vulnerable Snapdragon processors.
💻 Affected Systems
- Snapdragon Automobile
- Snapdragon Wearable
- Snapdragon Mobile MDM9206
- MDM9607
- MDM9650
- SD 210/SD 212/SD 205
- SD 400
- SD 410/12
- SD 425
- SD 430
- SD 450
- SD 600
- SD 602A
- SD 615/16/SD 415
- SD 617
- SD 625
- SD 650/52
- SD 800
- SD 808
- SD 810
- SD 820
- SD 820Am
- SD 835
- SD 845
- MSM8909W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with kernel privileges leading to complete device compromise, data theft, and persistent backdoor installation.
Likely Case
Application crash leading to denial of service, or limited code execution within the video processing context.
If Mitigated
Application crash without code execution if ASLR/DEP protections are effective, but still causes service disruption.
🎯 Exploit Status
Exploitation requires crafting malicious MP4 video files. No public exploit code available, but vulnerability is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android security patch level March 2018 or later
Vendor Advisory: https://source.android.com/security/bulletin/2018-03-01
Restart Required: Yes
Instructions:
1. Check for Android security updates. 2. Apply March 2018 or later security patch. 3. Reboot device. 4. Verify patch level in Settings > About phone > Android security patch level.
🔧 Temporary Workarounds
Disable automatic video processing
androidPrevent automatic parsing of video files in vulnerable applications
Use alternative video players
androidInstall video players with different codec libraries not affected by this vulnerability
🧯 If You Can't Patch
- Isolate affected devices from untrusted networks
- Implement application whitelisting to prevent execution of unknown video files
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone. If before March 2018, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows March 2018 or later date.📡 Detection & Monitoring
Log Indicators:
- Video processing service crashes
- Kernel panic logs related to video_fmt_mp4r
- Memory corruption errors in system logs
Network Indicators:
- Unusual video file downloads to affected devices
- Network traffic patterns showing video file delivery to multiple devices
SIEM Query:
source="android_logs" AND ("video_fmt_mp4r" OR "avc1" OR "MP4 parsing error")