Vulnerability Name:

CVE-2017-0553 (CCN-124490)

Assigned:2016-11-29
Published:2017-02-07
Updated:2019-10-03
Summary:An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065.
Note: this issue also exists in the upstream libnl before 3.3.0 library.
CVSS v3 Severity:7.0 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.1 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.0 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.1 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.6 High (CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-190
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2017-0553

Source: CONFIRM
Type: UNKNOWN
http://git.infradead.org/users/tgr/libnl.git/commit/3e18948f17148e6a3c4255bdeaaf01ef6081ceeb

Source: MLIST
Type: UNKNOWN
[libnl] 20170503 ANN: libnl 3.3.0 released

Source: CCN
Type: IBM Security Bulletin T1026208 (PowerKVM)
A vulnerability in libnl3 affects PowerKVM

Source: BID
Type: Third Party Advisory, VDB Entry
97340

Source: CCN
Type: BID-97340
Google Android libnl CVE-2017-0553 Remote Privilege Escalation Vulnerability

Source: SECTRACK
Type: UNKNOWN
1038201

Source: UBUNTU
Type: UNKNOWN
USN-3311-2

Source: REDHAT
Type: UNKNOWN
RHSA-2017:2299

Source: CCN
Type: Google Web site
Android

Source: XF
Type: UNKNOWN
android-cve20170553-priv-esc(124490)

Source: FEDORA
Type: UNKNOWN
FEDORA-2017-7a5363b41d

Source: FEDORA
Type: UNKNOWN
FEDORA-2017-34f6e70fdd

Source: CCN
Type: Android Open Source Project
Android Security Bulletin—April 2017

Source: CONFIRM
Type: Vendor Advisory
https://source.android.com/security/bulletin/2017-04-01

Source: UBUNTU
Type: UNKNOWN
USN-3311-1

Vulnerable Configuration:Configuration 1:
  • cpe:/o:google:android:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:5.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:5.1.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:5.1.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:7.1.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:7.1.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:google:android:5.1.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:7.1.1:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20172299
    P
    		RHSA-2017:2299: NetworkManager and libnl3 security, bug fix and enhancement update (Moderate)
    2017-08-01
    oval:com.ubuntu.cosmic:def:201705530000000
    V
    		CVE-2017-0553 on Ubuntu 18.10 (cosmic) - medium.
    2017-04-07
    oval:com.ubuntu.precise:def:20170553000
    V
    		CVE-2017-0553 on Ubuntu 12.04 LTS (precise) - medium.
    2017-04-07
    oval:com.ubuntu.bionic:def:201705530000000
    V
    		CVE-2017-0553 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-04-07
    oval:com.ubuntu.artful:def:20170553000
    V
    		CVE-2017-0553 on Ubuntu 17.10 (artful) - medium.
    2017-04-07
    oval:com.ubuntu.trusty:def:20170553000
    V
    		CVE-2017-0553 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-04-07
    oval:com.ubuntu.xenial:def:201705530000000
    V
    		CVE-2017-0553 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-04-07
    oval:com.ubuntu.bionic:def:20170553000
    V
    		CVE-2017-0553 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-04-07
    oval:com.ubuntu.xenial:def:20170553000
    V
    		CVE-2017-0553 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-04-07
    oval:com.ubuntu.disco:def:201705530000000
    V
    		CVE-2017-0553 on Ubuntu 19.04 (disco) - medium.
    2017-04-07
    oval:com.ubuntu.cosmic:def:20170553000
    V
    		CVE-2017-0553 on Ubuntu 18.10 (cosmic) - medium.
    2017-04-07
    BACK
    google android 5.0
    google android 5.0.1
    google android 5.0.2
    google android 5.1
    google android 5.1.0
    google android 5.1.1
    google android 6.0
    google android 6.0.1
    google android 7.0
    google android 7.1.0
    google android 7.1.1
    google android 5.1.1
    google android 6.0
    google android 6.0.1
    google android 5.0.2
    google android 7.0
    google android 7.1.1
    ibm powerkvm 3.1