CVE-2017-5217

Installing a zero-permission Android application on certain Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0) software can continually crash the system_server process in the Android OS. The zero-permission app will create an active install session for a separate app that it has embedded within it. The active install session of the embedded app is performed using the android.content.pm.PackageInstaller class and its nested classes in the Android API. The active install session will write the embedded APK file to the /data/app directory, but the app will not be installed since third-party applications cannot programmatically install apps. Samsung has modified AOSP in order to accelerate the parsing of APKs by introducing the com.android.server.pm.PackagePrefetcher class and its nested classes. These classes will parse the APKs present in the /data/app directory and other directories, even if the app is not actually installed. The embedded APK that was written to the /data/app directory via the active install session has a very large but valid AndroidManifest.xml file. Specifically, the AndroidManifest.xml file contains a very large string value for the name of a permission-tree that it declares. When system_server tries to parse the APK file of the embedded app from the active install session, it will crash due to an uncaught error (i.e., java.lang.OutOfMemoryError) or an uncaught exception (i.e., std::bad_alloc) because of memory constraints. The Samsung Android device will encounter a soft reboot due to a system_server crash, and this action will keep repeating since parsing the APKs in the /data/app directory as performed by the system_server process is part of the normal boot process. The Samsung ID is SVE-2016-6917.

• CWE-20
• CWE-119

• http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2017Vendor Advisory
• http://www.securityfocus.com/bid/95319
• http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2017Vendor Advisory
• http://www.securityfocus.com/bid/95319

Published

Jan 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5211Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected…
• CVE-2017-5212Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorre…
• CVE-2017-5213Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected…
• CVE-2017-5214The Codextrous B2J Contact (aka b2j_contact) extension befor…
• CVE-2017-5215The Codextrous B2J Contact (aka b2j_contact) extension befor…
• CVE-2017-5216Stack-based buffer overflow vulnerability in Netop Remote Co…
• CVE-2017-5218A SQL Injection issue was discovered in SageCRM 7.x before 7…
• CVE-2017-5219An issue was discovered in SageCRM 7.x before 7.3 SP3. The C…
• CVE-2017-5223An issue was discovered in PHPMailer before 5.2.22. PHPMaile…
• CVE-2017-5225LibTIFF version 4.0.7 is vulnerable to a heap buffer overflo…8.8
• CVE-2017-5226When executing a program via the bubblewrap sandbox, the non…
• CVE-2017-5227QNAP QTS before 4.2.4 Build 20170313 allows local users to o…