Sign-up

ID

VAR-201311-0282


CVE

CVE-2013-4740


TITLE

MSM For devices Qualcomm Innovation Center Android Used for contributions etc. Linux Kernel for Goodix gt915 Vulnerability of obtaining privilege in touch screen driver

Trust: 0.8

sources: JVNDB: JVNDB-2013-005072

DESCRIPTION

goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, relies on user-space length values for kernel-memory copies of procfs file content, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values. Android For MSM is prone to multiple local memory-corruption vulnerabilities that occur in the Goodix GT915 touchscreen driver because it fails to properly bounds-check user-supplied data. Local attackers can exploit these issues to execute arbitrary code. Failed exploit attempts may cause a denial-of-service condition. The Linux kernel is the kernel used by the open source operating system Linux released by the American Linux Foundation. The NFSv4 implementation is one of the distributed file system protocols. There is a security vulnerability in the goodix_tool.c file in the goodix gt915 touch screen driver of the Linux kernel 3.x version using the Android system. The issues were found in the write handler of the procfs entry created by the driver, which by default is readable and writeable to users without any specific privileges. CVE-2013-4740 ------------- When processing data written to the procfs file, the Goodix gt915 touchscreen driver is using user space supplied content as length values in subsequent memory manipulation operations without bounds checking. This can lead to multiple memory corruption issues. An application with access to the respective file can use this flaw to, e.g., elevate privileges. Access Vector: local Security Risk: high Vulnerability: CWE-20 (Improper Input Validation) CVE-2013-6122 ------------- When processing arguments passed to the procfs write handler of the Goodix gt915 touchscreen driver, user space data is copied to a global variable and used without a mutual-exclusion mechanism. The global structure used by the procfs write handler can be accessed concurrently by more than one process. This would allow local attackers to bypass the input validation checks (such as introduced by the fix for CVE-2013-4740). An application with access to the respective file can use this flaw to, e.g., alter the internal state of the handler, bypass security checks, or create a denial-of-service condition. Access Vector: local Security Risk: medium Vulnerability: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) Affected versions ----------------- All Android releases from CAF using a Linux kernel from the following heads: - jb_3* - msm-3.10 Patch ----- We advise customers to apply the following patches: https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05 Acknowledgement =============== Qualcomm Innovation Center, Inc. (QuIC) thanks Jonathan Salwan of the Sysdream Security Lab for reporting the related issues and working with QuIC to help improve Android device security. https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler

Trust: 2.07

sources: NVD: CVE-2013-4740 // JVNDB: JVNDB-2013-005072 // BID: 63661 // VULHUB: VHN-64742 // PACKETSTORM: 123945

AFFECTED PRODUCTS

vendor:qualcommmodel:quic mobile station modem kernelscope:eqversion:3.10

Trust: 1.6

vendor:qualcommmodel:quic mobile station modemscope:eqversion:3.10

Trust: 0.8

vendor:avayamodel:ip deskphonescope:eqversion:96x16.2

Trust: 0.3

vendor:avayamodel:ip deskphonescope:eqversion:96x16

Trust: 0.3

sources: BID: 63661 // JVNDB: JVNDB-2013-005072 // CNNVD: CNNVD-201311-152 // NVD: CVE-2013-4740

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-4740
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-4740
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201311-152
value: MEDIUM

Trust: 0.6

VULHUB: VHN-64742
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-4740
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-64742
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-64742 // JVNDB: JVNDB-2013-005072 // CNNVD: CNNVD-201311-152 // NVD: CVE-2013-4740

PROBLEMTYPE DATA

problemtype:CWE-362

Trust: 1.1

problemtype:CWE-119

Trust: 0.8

sources: VULHUB: VHN-64742 // JVNDB: JVNDB-2013-005072 // NVD: CVE-2013-4740

THREAT TYPE

local

Trust: 0.9

sources: BID: 63661 // CNNVD: CNNVD-201311-152

TYPE

competitive condition

Trust: 0.6

sources: CNNVD: CNNVD-201311-152

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-005072

PATCH
title:QCIR-2013-00009-1url:https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler
Trust: 0.8
title:input: touchpanel: fix security issues in GT915 driverurl:https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05
Trust: 0.8
title:linux-3.10.21url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=46699
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2013-005072 // 
            
            
            
            CNNVD: CNNVD-201311-152

EXTERNAL IDS
db:NVDid:CVE-2013-4740
Trust: 2.9
db:OPENWALLid:OSS-SECURITY/2013/11/08/1
Trust: 1.7
db:JVNDBid:JVNDB-2013-005072
Trust: 0.8
db:CNNVDid:CNNVD-201311-152
Trust: 0.7
db:MLISTid:[OSS-SECURITY] 20131108 ADVISORY REPORT - MULTIPLE MEMORY CORRUPTION AND RACE CONDITION IN GOODIX GT915 ANDROID TOUCHSCREEN DRIVER (CVE-2013-4740 & CVE-2013-6122)
Trust: 0.6
db:BIDid:63661
Trust: 0.4
db:PACKETSTORMid:123945
Trust: 0.2
db:VULHUBid:VHN-64742
Trust: 0.1
sources:
            
            
            VULHUB: VHN-64742 // 
            
            
            
            BID: 63661 // 
            
            
            
            JVNDB: JVNDB-2013-005072 // 
            
            
            
            PACKETSTORM: 123945 // 
            
            
            
            CNNVD: CNNVD-201311-152 // 
            
            
            
            NVD: CVE-2013-4740

REFERENCES
url:https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05
Trust: 2.1
url:https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler
Trust: 2.1
url:http://www.openwall.com/lists/oss-security/2013/11/08/1
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4740
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4740
Trust: 0.8
url:https://www.codeaurora.org/xwiki/bin/qaep/
Trust: 0.3
url:https://downloads.avaya.com/css/p8/documents/100178103
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-6122
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4740
Trust: 0.1
sources:
            
            
            VULHUB: VHN-64742 // 
            
            
            
            BID: 63661 // 
            
            
            
            JVNDB: JVNDB-2013-005072 // 
            
            
            
            PACKETSTORM: 123945 // 
            
            
            
            CNNVD: CNNVD-201311-152 // 
            
            
            
            NVD: CVE-2013-4740

CREDITS
Jonathan Salwan of Sysdream Security Lab
Trust: 0.3
sources:
            
            
            BID: 63661

SOURCES
db:VULHUBid:VHN-64742
db:BIDid:63661
db:JVNDBid:JVNDB-2013-005072
db:PACKETSTORMid:123945
db:CNNVDid:CNNVD-201311-152
db:NVDid:CVE-2013-4740

LAST UPDATE DATE
2025-04-11T23:02:51.589000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-64742date:2013-11-14T00:00:00
db:BIDid:63661date:2015-03-19T08:48:00
db:JVNDBid:JVNDB-2013-005072date:2013-11-13T00:00:00
db:CNNVDid:CNNVD-201311-152date:2013-11-13T00:00:00
db:NVDid:CVE-2013-4740date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-64742date:2013-11-12T00:00:00
db:BIDid:63661date:2013-11-07T00:00:00
db:JVNDBid:JVNDB-2013-005072date:2013-11-13T00:00:00
db:PACKETSTORMid:123945date:2013-11-07T23:02:22
db:CNNVDid:CNNVD-201311-152date:2013-11-13T00:00:00
db:NVDid:CVE-2013-4740date:2013-11-12T14:35:12.760