CVE-2016-11038 - OpenCVE

An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service doesn't implement access control for shared memory, leading to arbitrary code execution or privilege escalation. The Samsung ID is SVE-2016-5953 (July 2016).

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Samsung	Galaxy S5 Galaxy Note 3 Galaxy S6 Galaxy Note 4 Galaxy Note Edge Galaxy S6 Edge
Google	Android

Configuration 1 [-]

AND

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_note_3:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_note_4:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_note_edge:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_s5:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_s6:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_s6_edge:-:*:*:*:*:*:*:*

References

Link	Resource
https://security.samsungmobile.com/securityUpdate.smsb	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-04-07T13:17:05

Updated: 2020-04-07T13:17:05

Reserved: 2020-04-07T00:00:00

Link: CVE-2016-11038

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-04-07T14:15:13.497

Modified: 2020-04-09T18:28:47.867

Link: CVE-2016-11038

JSON object: View

Redhat Information

No data.

CWE

CWE-119

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_note_3:-:*:*:*:*:*:*:*", "matchCriteriaId": "B148CE20-A498-4F1E-9C2D-C38F9F15292D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_note_4:-:*:*:*:*:*:*:*", "matchCriteriaId": "65AD2209-F89B-4CF2-BFA6-710D4E8A965A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_note_edge:-:*:*:*:*:*:*:*", "matchCriteriaId": "8C58E9E1-08A0-4EA8-8EDE-CD7836A7289D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_s5:-:*:*:*:*:*:*:*", "matchCriteriaId": "7060E1BD-9FFF-4D74-A2EE-20ABB447EA23", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_s6:-:*:*:*:*:*:*:*", "matchCriteriaId": "E9C84354-75A3-4E55-A2D0-C0783AF36B37", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_s6_edge:-:*:*:*:*:*:*:*", "matchCriteriaId": "64C60E27-871F-4B77-87A5-9F9F20DCA2D3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service doesn't implement access control for shared memory, leading to arbitrary code execution or privilege escalation. The Samsung ID is SVE-2016-5953 (July 2016)."}, {"lang": "es", "value": "Se detect\u00f3 un problema en dispositivos m\u00f3viles Samsung con versiones de software hasta el 05-04-2019 (incorporando el Samsung Professional Audio SDK). El servicio de audio Jack no implementa el control de acceso para la memoria compartida, conllevando a una ejecuci\u00f3n de c\u00f3digo arbitraria o una escalada de privilegios. El ID de Samsung es SVE-2016-5953 (Julio de 2016)."}], "id": "CVE-2016-11038", "lastModified": "2020-04-09T18:28:47.867", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-07T14:15:13.497", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://security.samsungmobile.com/securityUpdate.smsb"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}