Stagefright

Stagefright refers to a group of vulnerabilities discovered in 2015 in libstagefright, the C++ media-playback library built into the Android operating system for processing video and audio formats such as MP4, 3GPP, and MPEG4. The bugs—mostly integer overflows and underflows in how the library parsed malformed media metadata (“atoms”)—could be exploited to achieve remote code execution simply by getting a target device to process a booby-trapped media file, in some cases delivered automatically via MMS before the user ever opened the message.

Discovery

The flaws were found by Joshua J. Drake, VP of Platform Research and Exploitation at the mobile security firm Zimperium. Drake reported the vulnerabilities to Google along with proposed patches beginning around April 2015; Google reportedly merged fixes into internal code branches within 48 hours of notification. Zimperium published its findings publicly on July 27, 2015 in a post titled “Experts Found a Unicorn in the Heart of Android,” describing the issue as one of the “worst Android vulnerabilities discovered to date.”

Disclosure and Black Hat 2015

Drake presented the full technical details in a talk titled “Stagefright: Scary Code in the Heart of Android” at Black Hat USA on August 5, 2015, followed by a related presentation at DEF CON 23 on August 7, 2015. Seven distinct CVE identifiers were assigned to the original disclosure: CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, and CVE-2015-3829. A second, related set of vulnerabilities dubbed “Stagefright 2.0,” including CVE-2015-6602, was disclosed later in 2015 and was reported to affect nearly all Android devices going back to version 1.0.

Impact and Scale

Because libstagefright was present across nearly the entire Android ecosystem, the vulnerabilities were estimated to expose roughly 950 million devices—about 95% of Android devices in use at the time—spanning Android 2.2 through 5.1.1. The attack surface was unusually broad: exploitation could reportedly occur through MMS messages, web browsing, or email attachments, and in the MMS scenario an attacker needed only the victim's phone number, with no interaction required from the user to trigger the exploit.

Android's Response

The scale and severity of Stagefright, combined with the slow, carrier-dependent pace of Android patch distribution at the time, pushed Google to formalize a monthly security update process. Google shipped fixes to partners and in the Nexus Security Bulletin published August 13, 2015, which it described as part of a new “Android Security Bulletin Monthly Release process.” This effectively institutionalized the ongoing Android Security Bulletin program that continues to ship monthly patches for the platform.

Timeline

• 2015-04-01Joshua Drake of Zimperium reports the Stagefright vulnerabilities and proposed patches to Google (approximate date; Google is reported to have merged fixes internally within 48 hours).
• 2015-07-27Zimperium publicly discloses the research in the blog post "Experts Found a Unicorn in the Heart of Android."
• 2015-08-05Joshua Drake presents "Stagefright: Scary Code in the Heart of Android" at Black Hat USA 2015.
• 2015-08-07Related presentation given at DEF CON 23.
• 2015-08-13Google publishes the Nexus Security Bulletin for August 2015, addressing the Stagefright CVEs and inaugurating its monthly Android Security Bulletin process.