The Patching Friars' AlmanacA calendar of CVE saints

August 7

QuadRooterHoly card for quadrooter, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 IV QuadRooter QUATTUOR RADICES
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint QuadRooter, of the Four Roots

Patron of smartphones with Qualcomm chips, patches that wait on the carrier, and apps that ask for no permissions.

Life

On 7 August 2016, at DEF CON in Las Vegas, Check Point unveiled QuadRooter, four vulnerabilities in the drivers Qualcomm shipped with its chipsets. A malicious app, even without special permissions, could use any one of them to gain root privileges. Some 900 million Android devices were at risk, and the fixes had to travel the long chain from Qualcomm to manufacturers and carriers before reaching the phones.

Prayer

O Saint QuadRooter, who put down roots in nine hundred million pockets, let patches travel from chip to phone faster than malicious apps. Amen.

How to celebrate

Celebrated by installing Android security updates as soon as the manufacturer allows and getting apps only from official stores.

Four roots beneath the chip, one root above them all.

Technical record

Disclosed on
August 7 2016
CVE
CVE-2016-2059CVE-2016-5340CVE-2016-2503CVE-2016-2504

The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.

Sources: checkpoint.com · blog.checkpoint.com · blackhat.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.