What is QuadRooter? Are 900 million Android devices vulnerable? What actually is QuadRooter and how does it work on Android devices?

It is currently in the news that 900 millions Android devices are vulnerable:


  Serious security flaws that could give attackers complete access to a phone's data have been found in software used on tens of millions of Android devices.
  
  The bugs were uncovered by Checkpoint researchers looking at software running on chipsets made by US firm Qualcomm.
  
  Qualcomm processors are found in about 900 million Android phones, the company said.


The article also said that it is something at the chipset level.

Is this true?

And how does this work internally?
What is QuadRooter?


Quadrooter is a name for a set of security vulnerabilities including


CVE-2016-2059
CVE-2016-2504
CVE-2016-2503
CVE-2016-5340


These are weaknesses in Linux/Android system software provided by chipset manufacturer Qualcomm.

They could be exploited by an app that you download, even one that does not ask for any special privileges. Such an app could exploit these vulnerabilities to gain higher level control of your phone, including access to any private data you have stored on it.



The US National Vulnerability Database gives the following description for the  vulnerabilities listed above

2059


  The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.


2504


  The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28026365 and Qualcomm internal bug CR1002974.


2503


  The Qualcomm GPU driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28084795 and Qualcomm internal bug CR1006067.


5340


  The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.




You can download an app named "Quadrooter Scanner" from the Google Play store - it will tell you if your phone is vulnerable. The app was written by Checkpoint Software Technologies Ltd. I have installed it, ran it and uninstalled it. Other than that, I cannot say if it is reliable in any way.

Qualcomm have issued software fixes to manufacturers

Google have addressed a couple of these in their security bulletins for July and August

Issue                                    CVE            Severity    Affects 
                                                                    Nexus?
Elevation of privilege vulnerability in  CVE-2016-2503,  Critical   Yes
Qualcomm GPU driver (Device specific)    CVE-2016-2067


...

Elevation of privilege vulnerability in  CVE-2016-2504,  Critical   Yes
Qualcomm GPU driver                      CVE-2016-3842


...

Elevation of privilege vulnerability in Qualcomm GPU driver

An elevation of privilege vulnerability in the Qualcomm GPU driver could 
enable a local malicious application to execute arbitrary code within the 
context of the kernel. This issue is rated as Critical due to the 
possibility of a local permanent device compromise, which may require 
reflashing the operating system to repair the device.

CVE References  Severity    Updated Nexus devices   Date reported
CVE-2016-2504    Critical   Nexus 5, Nexus 5X,      Apr 5, 2016
A-28026365                  Nexus 6, Nexus 6P, 
QC-CR#1002974               Nexus 7 (2013)




I suspect owners of vulnerable phones have a number of options including some or all of


wait for manufacturer to provide an over the air update to fix this.
don't download any new apps
prevent apps from being updated until vulnerabilities are fixed
uninstall all superfluous apps
power down the phone until sure a fix is ready


I guess many people would regard at least the last item as overkill.




  Are 900 million Android devices vulnerable?


Worldwide sales of smartphones are of the order of 1 billion each year.

Qualcomm are a major manufacturer of integrated circuits used in smartphones. They sell a variety of ICs including the popular "Snapdragon" range of ARM-based CPUs. Their annual revenues are of the order of USD 25 billion. 

According to Forbes


  According to ABI Research, leading chipset maker Qualcomm remained a leader in the LTE baseband chipsets in 2015. The company held a massive 65% of the LTE baseband chipset market in the year. 


There may be 2 billion smartphones in use in 2016. Of course, a lot of these will be IOS devices. There may still be one or two Windows phone users out there :-).

The average lifetime of a smartphone might be two years or might be four years. There is certainly a market in second hand smartphones. It seems plausible that many smartphones older than one year are still in use.

Of course, there are Android devices that are not smartphones. Google estimates there are 1.4 billion active Android devices worldwide. 65% of 1.4 billion is 910 million. This might be how journalists arrived at this figure. If so, it isn't at all accurate.

However, assuming that the vulnerable drivers have existed for several years, it seems plausible that hundreds of millions of devices might be affected. 900 million seems to be the extreme upper end of possible estimates.



Related


2016-08-10 "Google says most users 'protected' against 'Quadrooter' - Play Store should spot exploits"
2016-08-08 QuadRooter vulnerability: 5 things to know about this Android security scare