CVE-2016-8438

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass (Peripheral Image Loader) PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR#1023638.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-84399.8Possible buffer overflow in trust zone access control API. Buffer overflow may occur due to lack of buffer size checking. Product: Android. CVE-2016-84409.8Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite CVE-2016-84417.8Possible buffer overflow in the hypervisor. Inappropriate usage of a static array could lead to a buffer overrun. Product: Android. Versions CVE-2016-84427.8Possible unauthorized memory access in the hypervisor. Lack of input validation could allow hypervisor memory to be accessed by the HLOS. Pr CVE-2016-84437.8Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. V CVE-2016-84447.0An elevation of privilege vulnerability in the Qualcomm camera could enable a local malicious application to execute arbitrary code within t CVE-2016-84457.0An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local maliciou CVE-2016-84467.0An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local maliciou CVE-2016-84477.0An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local maliciou CVE-2016-84487.0An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local maliciou CVE-2016-84497.0An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within CVE-2016-84507.0An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi