The kernel fixes a Local Elevation of Privilege Vulnerability that affects a large number of Android devices.

The kernel fixes a Local Elevation of Privilege Vulnerability that affects a large number of Android devices.

Perception Point researchers discovered a Linux kernel Local Elevation of Privilege Vulnerability, affecting Versions later than 3.8. Using this vulnerability on servers requires local access, however, the affected Android devices are unlikely to be corrected.

The Android system that uses the 3.8 + kernel includes KitKat, Lollipop, and kernel mallow. Jellybean uses the 3.4.39 kernel, so it is not affected. The Lollipop and kernel mallow enable SELinux to shield related system calls, vulnerabilities cannot be exploited in these systems. Therefore, the affected devices are KitKat, with a market share of 36%.

The researchers explained the vulnerability: if a process causes kernel leakage 0x100000000 to be referenced to the same object, it may make the kernel think that the object is no longer referenced, and then release the object. If a process occupies another legal reference and uses this reference after the object is released, this will cause the kernel to re-allocate the reference or re-assign the memory.