CVE-2017-13168

What it actually does

Local privilege escalation flaw in the kernel SCSI driver allowing a process with limited privileges to obtain root-level access on the system.

Why it matters to the business

Attackers who already have a foothold on a device can take full control, resulting in data compromise, persistent malware, or unauthorized device usage across Android and Linux deployments.

How an attack unfolds

An attacker with local code execution (for example via a malicious application) triggers the vulnerable SCSI driver code path to bypass privilege boundaries and obtain root access.

How to fix it

Apply kernel updates that resolve the SCSI driver vulnerability; for Android devices follow the vendor security bulletin and for Ubuntu apply the corresponding kernel package updates from Canonical.

How to confirm the fix worked

Confirm devices are running a kernel version containing the fix referenced in the Android security bulletin or Ubuntu advisory; test that the vulnerable SCSI code paths are no longer reachable with unprivileged credentials.

Typical attack path

1. Obtain local execution via malicious app or process
2. Invoke SCSI driver functionality that contains the flaw
3. Escalate privileges to root
4. Install persistence mechanisms or exfiltrate data

How to detect it

Examine kernel and system logs for anomalous SCSI driver activity or unexpected privilege changes; monitor for new root-owned processes originating from non-standard entry points.

What your security team should do

• Prioritize kernel updates on all affected Android and Ubuntu systems
• Limit local application execution privileges where possible
• Review device update policies to reduce exposure windows for kernel flaws