Published:2014/12/02  Last Updated:2014/12/02

Multiple improper data validation vulnerabilities in Syslink driver for Texas Instruments OMAP mobile processors


The Syslink driver for OMAP mobile processors contained in Android devices contain mulitple improper data validation vulerabilities.

Products Affected

Multiple products are affected.
For more information, refer to the information provided by the developer or provider.


The OMAP mobile processor provided by Texas Instruments is used in some Android tablets, smartphones and other devices. The Syslink driver for some OMAP mobile processors is used to implement the communication of processes between the host and slave processors.
The Syslink driver contains multiple vulnerabilities where userland data is not properly validated prior to use. Exploitation of these vulnerabilities may lead to arbitrary code execution or kernel memory content disclosure.


When the device is accessed through the Android Debug Bridge (adb), contents of the kernel memory may be obtained or arbitrary code may be executed to obtain root privileges.


Apply an Update
Apply the appropriate update according to the information provided by the developer or provider.

Vendor Status

Vendor Status Last Update Vendor Notes
NEC Corporation Not Vulnerable 2014/12/02
NTT DOCOMO, INC. Vulnerable 2014/12/02
SoftBank Vulnerable 2014/12/02


  1. Texas Instruments Incorporated
    OMAP™ Mobile Processors : OMAP™ 4 Platform
  2. Syslink Project

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2014.12.02 (CVSS Base Metrics)

What is CVSS?

Measures Severity Description
Access Vector(AV) Local (L) Adjacent Network (A) Network (N) A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account.
Access Complexity(AC) High (H) Medium (M) Low (L) Specialized access conditions exist.
Authentication(Au) Multiple (M) Single (S) None (N) Authentication is not required to exploit the vulnerability.
Confidentiality Impact(C) None (N) Partial (P) Complete (C) There is total information disclosure, resulting in all system files being revealed.
Integrity Impact(I) None (N) Partial (P) Complete (C) There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.
Availability Impact(A) None (N) Partial (P) Complete (C) There is a total shutdown of the affected resource.

Base Score:6.2


Masaaki Chida of GREE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2014-7252
JVN iPedia JVNDB-2014-000137