CVE-2017-5217 is a denial-of-service vulnerability affecting specific Samsung Android devices running Android versions 4.4, 5.0/5.1, and 6.0. An attacker can install a zero-permission application that embeds a specially crafted APK with an excessively large AndroidManifest.xml file. During the normal boot process, Samsung's modified Android Open Source Project (AOSP) attempts to parse this malformed APK, causing the system_server process to crash repeatedly due to memory exhaustion, leading to an endless soft reboot loop. The vulnerability has a CVSS v3.0 score of 5.5 (Medium), indicating a local attack vector with low attack complexity, requiring user interaction (installing the malicious app), and resulting in high availability impact (system crash). There is no confidentiality or integrity impact. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or interest.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.4CPE matchmatch criteria | cpe:2.3:o:samsung:samsung_mobile:4.4:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:o:samsung:samsung_mobile:5.0:*:*:*:*:*:*:* | ||
5.1CPE matchmatch criteria | cpe:2.3:o:samsung:samsung_mobile:5.1:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:samsung:samsung_mobile:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.