Full Report
A vulnerability in Android's Wi-Fi Direct functionality has been uncovered by security researchers.
Analysis Summary
# Vulnerability: Android Wi-Fi Direct Denial of Service via Malformed Probe Response
## CVE Details
- CVE ID: Not explicitly provided in the text. (This summary uses the information available, noting unavailability.)
- CVSS Score: Not explicitly provided.
- CWE: Likely CWE-20 (Improper Input Validation) or related to Denial of Service.
## Affected Systems
- Products: Android devices utilizing Wi-Fi Direct functionality.
- Versions:
- Nexus 5 (Android 4.4.4)
- Nexus 4 (Android 4.4.4)
- LG D806 (Android 4.2.2)
- Samsung SM-T310 (Android 4.2.2)
- Motorola RAZR HD (Android 4.1.2)
- Configurations: Devices actively scanning for Wi-Fi Direct products.
## Vulnerability Description
The vulnerability is a remotely exploitable Denial of Service (DoS) flaw residing within Android's Wi-Fi Direct stack. An attacker can send a specially crafted IEEE 802.11 Probe Response frame or a malformed `wpa_supplicant` event. This triggers an uncaught exception (specifically, an `IllegalArgumentException` in the `WifiP2pDevice` class or an exception in the `WiFiMonitor` class within the Dalvik subsystem), causing the device to reboot.
## Exploitation
- Status: PoC available (Implied by researcher disclosure, though not explicitly confirmed as public PoC).
- Complexity: Low to Medium (Requires proximity and the device to be actively scanning).
- Attack Vector: Adjacent (Requires proximity to send the malicious frame).
## Impact
- Confidentiality: No impact stated.
- Integrity: No impact stated beyond the temporary disruption of service.
- Availability: High impact (Device reboot/Denial of Service for user).
## Remediation
### Patches
- Google classified the issue as "low severity" and at the time of the article, no timeline for a fix was provided to the public by the Android Security Team. (Specific patch details are unavailable in this source.)
### Workarounds
- Keep the device physically distant from potential attackers.
- Ensure the device is not actively scanning for Wi-Fi Direct devices during critical operations (though scanning is often passive or system-controlled).
## Detection
- Indicators of Compromise: Unexplained device reboots when the device is near unknown Wi-Fi Direct services or while attempting to connect/scan.
- Detection Methods and Tools: Monitoring system logs for specific exceptions related to Wi-Fi processing (`IllegalArgumentException` in `WifiP2pDevice` or exceptions in `WiFiMonitor` during Wi-Fi scan intervals).
## References
- Vendor Advisories: Core Security advisory was disclosed to Google on September 26 (year implied as 2014 based on article date).
- Relevant links:
- hxxps://www.welivesecurity.com/en/mobile-security/android-wifi-direct-bug-means-hackers-can-reboot-your-device/
- hxxp://www.coresecurity.com/advisories/android-wifi-direct-denial-service
- hxxp://thehackernews.com/2015/01/WiFi-direct-android-hacking.html