PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0446 Google CVE debrief

CVE-2017-0446 is a high-severity Android elevation-of-privilege issue affecting the HTC touchscreen driver path. The published description says a local malicious application could execute arbitrary code in the kernel context, but exploitation is not a simple one-step local bug: it first requires compromising a privileged process. That combination makes the issue especially important on devices where the affected driver stack is present, because kernel-context compromise can undermine the integrity of the whole device.

Vendor
Google
Product
Unknown
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-08
Original CVE updated
2026-05-13
Advisory published
2017-02-08
Advisory updated
2026-05-13

Who should care

Android platform teams, OEM/device maintainers, kernel and driver security owners, and fleet defenders responsible for devices using the HTC touchscreen driver stack or Android kernel 3.18 builds listed as vulnerable in NVD.

Technical summary

The CVE description identifies an elevation-of-privilege condition in the HTC touchscreen driver. NVD classifies the attack as local with high complexity and user interaction, and the impact vector is confidentiality, integrity, and availability high. The record also lists vulnerable CPEs for Android up to 7.1.1 and Linux kernel 3.18. The weakness mapping is not specific beyond NVD-CWE-noinfo, so defenders should treat this as a driver/kernel memory or privilege boundary issue rather than assume a single root cause.

Defensive priority

High

Recommended defensive actions

  • Apply the Android vendor security bulletin fixes referenced for this CVE and verify the affected build is no longer in use.
  • Inventory devices and kernels that match the vulnerable CPEs, especially Android builds up to 7.1.1 and Linux kernel 3.18.
  • Prioritize devices or product lines that include the HTC touchscreen driver path identified in the CVE description.
  • Reduce exposure to privileged-process compromise paths, since the CVE description says exploitation depends on first compromising a privileged process.
  • Use kernel hardening, least-privilege app controls, and prompt patch deployment to limit the impact of local driver escalation bugs.

Evidence notes

Source corpus states: "An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel." It also states: "This issue is rated as High because it first requires compromising a privileged process." NVD metadata lists CVSS vector CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, vulnerable CPEs for android up to 7.1.1 and linux_kernel 3.18, and weakness NVD-CWE-noinfo. The Android security bulletin reference is included in the corpus as the vendor advisory/patch reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-0446 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-0446

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-0446 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0446

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.