VDB
CVE-2014-7953
CVE-2014-7953
PUBLISHED
CVSS 7 HIGH
Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat's output looking for a dexopt line, which once found should execute bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.
EPSS 0.33% · 26.6th percentile
Risk Scores
CVSS 3.0
7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.33%
26.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | * |
| android | 4.4.4 |
Timeline
- Jul 7, 2017 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
References
- 74213 vdb
- https://android.googlesource.com/platform/frameworks/base/+/a8f6d1b%5E%21/ url
- 20150417 CVE-2014-7953 Android backup agent code execution mailing-list
- 20150417 CVE-2014-7953 Android backup agent code execution mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2014-7953 advisory
- https://android.googlesource.com/platform/frameworks/base/+/a8f6d1b%5E! url
- https://android.googlesource.com/platform/frameworks/base/+/a8f6d1b%5E%21 url