LG posts January security bulletin ahead of Google with Android and LG-specific patches

Google has been releasing monthly security patches like clockwork ever since it revamped the Android security model in the wake of Stage Fright. Samsung and LG are also trying to keep up with the monthly patches, but not always with the most success. LG's getting the jump on Google today, though. It has posted the January security bulletin a little early with information on Google and LG-specific patches.
You can check LG's security page for the full list or patches (under the LG Security Bulletin tab). There are 81 total patches from Google and LG. Only eight of them are for LG devices only. LG's page links to the Google security bulletin page, but of course that still shows the December patch info. You can expect more detail on the Google patches when Mountain View gets around to posting its update next week. Some are already public and include things like arbitrary code execution and kernel privilege escalation flaws.
LG has descriptions of all its internal bugs, one of which is critical and involves user data leaking on MediaTek devices. The high and moderate level patches cover various privilege escalation vulnerabilities. These patches will be delivered to devices like the G3, G4, G4 Stylus, G5, V10, V20, CK, and G Stylo. There are no specifics on release date, which will vary by carrier and region.

LG Mobile Security Maintenance Release Summary (SMR)

The January Security Bulletin contains the 81 patches for the vulnerabilities from Google and LG. The most severe of these vulnerabilities is a Critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files. The security patch level is [2017-01-01] and the patches contains the fix for the 73 CVE items and the 8 LVE items. The LG vulnerabilities and exposures (LVE) items are described in detail below.

Security issues Summary

CVE Items from Google patch (Android Bulletin January 2016)
  • critical:
    CVE-2017-0381, CVE-2016-5180, CVE-2016-8411, CVE-2016-4794, CVE-2016-5195, CVE-2015-8966, CVE-2016-9120
  • high:
    CVE-2017-0382, CVE-2017-0383, CVE-2017-0384, CVE-2017-0385, CVE-2017-0386, CVE-2017-0387, CVE-2017-0388, CVE-2016-3911, CVE-2016-6710, CVE-2017-0389, CVE-2017-0390, CVE-2017-0391, CVE-2017-0392, CVE-2017-0393, CVE-2017-0394, CVE-2014-4014, CVE-2015-8967, CVE-2016-6778, CVE-2016-6779, CVE-2016-6780, CVE-2016-6492, CVE-2016-6781, CVE-2016-6782, CVE-2016-6783, CVE-2016-6784, CVE-2016-6785, CVE-2016-6758, CVE-2016-6759, CVE-2016-6760, CVE-2016-6761, CVE-2016-6755, CVE-2016-6786, CVE-2016-6787, CVE-2016-6788, CVE-2016-6791, CVE-2016-8391, CVE-2016-8392, CVE-2015-7872, CVE-2016-8393, CVE-2016-8394, CVE-2014-9909, CVE-2014-9910, CVE-2016-1583, CVE-2016-8396, CVE-2016-5341
  • moderate:
    CVE-2017-0395, CVE-2017-0396, CVE-2017-0397, CVE-2017-0398, CVE-2017-0399, CVE-2017-0400, CVE-2017-0401, CVE-2017-0402, CVE-2016-6720, CVE-2016-8399, CVE-2016-6756, CVE-2016-6757, CVE-2016-8401, CVE-2016-8402, CVE-2016-8403, CVE-2016-8404, CVE-2016-8405, CVE-2016-8406, CVE-2016-8407, CVE-2016-8410
  • low:
    CVE-2016-6690
LG Vulnerabilities and Exposures(LVE) Items from LG
  • critical:
    LVE-SMP-160019
  • high:
    LVE-SMP-160013, LVE-SMP-160014
  • moderate:
    LVE-SMP-160011, LVE-SMP-160015, LVE-SMP-160017, LVE-SMP-160018
  • low:
    LVE-SMP-160012

Security issues Details

You can see the detail information on Google patches from Android Security Bulletin site.There is a description of the security issue, a severity, affected devices information and date reported.
LVE-SMP-160019
  • Severity : Critical
  • Date reported : Nov 17, 2016
  • Affected device Informaion : L(5.0/5.1), M(6.0/6.0.1), N(7.0) devices with MTK chipset
  • Description :
    MTKLogger application that logs personal information to storage without user consent can be started by third-party application without user consent.
LVE-SMP-160013
  • Severity : High
  • Date reported : Nov 15, 2016
  • Affected device Informaion : Devices with LG Touchscreen driver
  • Description :
    An elevation of privilege vulnerability in write_file/write_log of LG touch driver could enable a local malicious application to execute arbitrary code within the context of the kernel.
LVE-SMP-160014
  • Severity : High
  • Date reported : Nov 15, 2016
  • Affected device Informaion : L(5.0.2), M(6.0) device using LG felica driver
  • Description :
    An elevation of privilege vulnerability in the LG felica drivers can be exploited to gain read/write access to kernel memory.
LVE-SMP-160017
  • Severity : Moderate
  • Date reported : Nov 15, 2016
  • Affected device Informaion : Devices with LG Touchscreen driver
  • Description :
    An elevation of privilege vulnerability in touch_synaptics/reg_ctrl of LG touch driver could enable a local malicious application to execute arbitrary code within the context of the kernel.
LVE-SMP-160018
  • Severity : Moderate
  • Date reported : Nov 15, 2016
  • Affected device Informaion : L(5.0/5.1), M(6.0/6.0.1), N(7.0) devices with LG fc8080 tdmb driver
  • Description :
    Elevation of privilege vulnerability in LG fc8080 tdmb driver could enable usermode supplies a kernel address as the ioctl argument, this will result in kernel memory corruption and can likely be exploited to achieve privilege elevation.
LVE-SMP-160012
  • Severity : Moderate
  • Date reported : Nov 15, 2016
  • Affected device Informaion : L(5.0/5.1), M(6.0/6.0.1), N(7.0) devices using snapdragon 801, 808, 820
  • Description :
    Directory traversal vulnerability in lghashstorageserver binder service could enable an app to read and write 0x20 bytes from any files in the context of the lghashstorageserver. It will result in system file compromised and can be likely to be exploited to achieve privilege elevation.
Acknowledgements
We would like to thank the following researchers for their contributions.
  • Mark Brand of Google Project Zero : LVE-SMP-160011,LVE-SMP-160012,LVE-SMP-160013,LVE-SMP-160014,LVE-SMP-160015,LVE-SMP-160017,LVE-SMP-160018

Comments

Post a Comment

Popular posts from this blog

Linktree’s free workaround lets you add multiple links to your Instagram bio

Image
Instagram only gives you one opportunity to link to outside resources inside its photo sharing platform. This might not be a problem for a majority of the users, but for those wanting a little more customization and even more options, it leaves much to be desired. Enter  Linktree , a free tool for Instagram designed to improve traffic to your outside link, be it a blog, portfolio, or store. How it works is fairly straightforward. After connecting Linktree to your Instagram profile, you’ll receive a single link to place in your Instagram bio. Once that link in place, you can customize what it’s linked to within your browser, be it a single website, or a collection of sites you’re looking to direct followers to Say you’re a photographer who’s using Instagram as a marketing tool for your wedding photography. Using Linktree, you can direct Instagram followers to your blog, your portfolio site, and even your other social media accounts. Until now, you would’ve been stuck c...
Read more

EVERYTHING WE KNOW ABOUT THE PIXEL 4, THE MOST-LEAKED PHONE EVER

Image
Google’s  Pixel 3 might have been the  most-leaked phone in history . Long before its unveiling, we knew practically everything about it from unboxing videos, photo comparisons, even a full review of the device. Surely, for the Pixel 4, Google would clamp down on leaks to leave some surprises for its debut on  October 15th , right? Let’s just say, if that was the plan, it didn’t exactly work out. We’ve now seen the Pixel 4 XL from every angle and in three different colors. At least seven different sources have touched this phone, many of them confirming the same specs. We not only know which cameras it’ll have, but also what they may be capable of, including air gestures (go figure). That doesn’t even count information Google has already shared  on purpose. So if you want to know almost everything about the Pixel 4 nearly a month before it’s announced, buckle up. We’ve sifted through all of the rumors and information we can find to compile everything we know —...
Read more

Our favorite iOS apps for the iPhone and iPad in 2018

Image
As 2018 comes to a close, it’s time to look at some our favorite apps of the year. While not all of these are brand new, many of them popped up onto our radar for the first time in 2018, and are definitely worth the attention. Others are some of our favorites that are still best-in-class despite having been around for some time now. We aim to do things differently at TNW, and as such you’re not going to find the recommendations you’re probably used to seeing: Gmail, Skype, Dropbox, and the like. Instead, we want to focus on the best-of-the-best that you may not have heard of, and others that are just special enough to warrant a mention. As always, we’d encourage you to share some of your favorites in the comments below, or on Facebook. Enlight Pixaloop (Free Pixaloop  is one of my favorite apps on the market. Unlike typical image editors that allow you to remove red eye or apply a filter, Pixaloop allows you to create stunning photo animations with a few c...
Read more