CVE-2014-9910 Google CVE debrief

Who should care

Android platform defenders, OEM security teams, mobile device fleet owners, and anyone responsible for devices running Android builds that include the Broadcom Wi‑Fi driver. Kernel-level impact makes this especially important for enterprise-managed phones and tablets.

Technical summary

The vulnerability is described as an elevation of privilege in the Broadcom Wi‑Fi driver on Android. The impact is kernel-context arbitrary code execution from a local malicious application, but the path to exploitation depends on first compromising a privileged process. NVD classifies the weakness under CWE-264 and provides a CVSS 3.0 vector of AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, high attack complexity, and user interaction requirements. The NVD CPE criteria indicate affected Android versions through 7.1.0.

Defensive priority

High. Kernel-context impact warrants prompt review even though exploitation is not remote and requires additional conditions. Prioritize patch verification on Android devices and confirmation that vendor security updates covering this issue are deployed.

Recommended defensive actions

• Confirm whether managed Android devices are on builds at or below the affected range identified by NVD (through Android 7.1.0).
• Verify installation of the vendor security update referenced in Google’s Android Security Bulletin for 2016-12-01.
• Treat devices with Broadcom Wi‑Fi driver exposure as higher priority for remediation and inventory them accordingly.
• Apply standard mobile hardening to reduce the chance of privileged-process compromise, since the CVE description says exploitation depends on that precondition.
• Monitor for vendor firmware, OS, or OEM patch advisories that explicitly mention this Android kernel-driver issue.

Evidence notes

This debrief is based only on the supplied CVE/NVD corpus and the linked vendor/security references. The key facts used here are: Android product scope; Broadcom Wi‑Fi driver involvement; potential kernel-context code execution; the stated prerequisite of compromising a privileged process; NVD’s Android CPE range through 7.1.0; CVSS vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H; and the Google Android Security Bulletin reference dated 2016-12-01. The CVE published date used for timing context is 2017-01-18, and the NVD modified timestamp is not treated as the issue date.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.