Security readout for executives and security teams
Plain-English summary
CVE-2017-0845 is an Android framework denial-of-service issue in syncstorageengine. The available sources identify affected Android versions but do not explain the crash condition, attacker requirements, or business impact beyond denial of service.
Executive priority
Treat this as a legacy Android hygiene issue unless internal inventory shows many affected devices in sensitive workflows. The impact is denial of service, but severity cannot be reliably ranked from the supplied evidence.
Technical view
The record maps the issue to Android ID A-35028827 in the Android framework syncstorageengine. Affected versions listed are Android 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. No CVSS, CWE, or technical root cause is provided.
Likely exposure
Exposure is most likely on devices still running the listed Android versions without the vendor security update that addressed CVE-2017-0845. Unsupported legacy devices are the main concern.
Exploitation context
The provided bundle does not show active exploitation, and KEV is false. Public evidence here does not state exploit availability, attack vector, required privileges, or whether user interaction is needed.
Researcher notes
The source bundle is sparse: no CVSS vector, CWE, root cause, trigger path, or commit details are included. Analysis should stay anchored to Android framework syncstorageengine, A-35028827, and the listed Android versions.
Mitigation direction
- Review Google and OEM guidance for CVE-2017-0845 and Android ID A-35028827.
- Apply the relevant Android or Pixel security update from official vendor channels.
- Prioritize replacement or isolation for unsupported Android 5.x, 6.x, and 7.x devices.
- Track OEM patch status because Android fixes often depend on device vendor delivery.
Validation and detection
- Inventory Android devices and identify versions 5.0.2 through 7.1.2.
- Check each device security patch level against vendor bulletins for CVE-2017-0845.
- Confirm OEM release notes mention CVE-2017-0845 or Android ID A-35028827.
- Flag devices that cannot receive vendor security updates for risk treatment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-0845 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/pixel/2017-11-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.