A recent flaw found in Qualcomm chips put users at risk. The vulnerability makes it possible for malicious attackers to steal user text messages and call history. “Recent” is relatively speaking, since the flaw was found by researchers from FireEye and patched by Qualcomm in March. But since the vulnerability was first accidentally introduced five years ago, there are still lots of devices affected because they lose manufacturer support as time goes on.

FireEye,_Inc._logo.svg

The flaw, called CVE-2016-2060 is found on a component of Android devices called “netd“. Qualcomm first adjusted this component in order to give users more tethering capabilities. However, malicious apps can exploit the flaw in order to execute commands as the radio system user.

A security advisory released by the Qualcomm Innovation Center says the flaw affects all Android Jelly Bean, KitKat and Lollipop devices. Google included CVE-2016-2060 in its May Android Security Bulletin which was published today. The flaw is rated “high severity” because “it can be used to gain elevated capabilities, such as Signature or SignatureOrSystem permissions privileges, which are not accessible to a third-party application.”

Note: Select outbound links may include affiliate tracking codes and AndroidGuys may receive compensation for purchases. Read our policy. As an Amazon Associate we earn from qualifying purchases.

2 COMMENTS

  1. And we who don’t own a Nexus phone will not see this update for a few months, if ever. I am glad that the FCC and FTC is getting involved by questioning the OEMs and wireless carriers about their update practices.

    Thank you for posting this info – it’s good to know.

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.