PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0438 Linux CVE debrief

CVE-2017-0438 is a high-severity Android kernel vulnerability affecting Qualcomm Wi‑Fi driver code in Android kernel 3.10 and 3.18 builds. The advisory says a local malicious application could execute arbitrary code in kernel context, with the issue rated High because it first requires compromising a privileged process. NVD also classifies the issue as local, high-complexity, and high-impact. Administrators should treat this as a kernel patching issue for affected Android devices and downstream OEM builds.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-08
Original CVE updated
2026-05-13
Advisory published
2017-02-08
Advisory updated
2026-05-13

Who should care

Android OEMs, device maintainers, and enterprise teams managing Android fleets that ship kernel-3.10 or kernel-3.18 builds with Qualcomm Wi‑Fi driver code. Security teams responsible for backported Android kernel patches should also review their device-specific builds, especially where third-party app installation is allowed.

Technical summary

The CVE describes an elevation-of-privilege flaw in the Qualcomm Wi‑Fi driver on Android. The primary impact is kernel-context arbitrary code execution from a local malicious application. The NVD record maps the issue to Android versions up to 7.1.1 and Linux kernel 3.10 and 3.18 CPEs, and assigns CVSS 3.0 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H with CWE-120.

Defensive priority

High. This is a kernel-level issue with potential for full device compromise within the kernel context, but the published data indicates nontrivial exploitation conditions. It should still be prioritized alongside other kernel and OEM firmware updates because affected devices may remain vulnerable until vendor backports are applied.

Recommended defensive actions

  • Check whether any supported Android devices, downstream builds, or custom ROMs include affected Qualcomm Wi‑Fi driver code from kernel 3.10 or 3.18.
  • Apply the Android Security Bulletin 2017-02-01 updates and any OEM/vendor backports that address this CVE.
  • Verify patch status across all device variants, including vendor kernels and long-term-support branches that may not share the same upstream version strings.
  • Prioritize remediation on fleets that allow untrusted third-party app installation or that run older Android releases mapped by NVD as vulnerable through 7.1.1.

Evidence notes

The corpus ties this CVE to an Android vendor advisory dated 2017-02-01 and an NVD record published on 2017-02-08. NVD lists affected CPEs for Android up to 7.1.1 and Linux kernel 3.10/3.18, and records CVSS 3.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H plus CWE-120. The source corpus also contains a vendor-attribution mismatch: the provided vendor field says Linux, while the description and references clearly point to Android/Qualcomm Wi‑Fi driver content.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-0438 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-0438

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-0438 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0438

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.