Security readout for executives and security teams
Plain-English summary
CVE-2017-13305 is an information disclosure issue in the upstream kernel encrypted-keys component, listed for Android kernel. In business terms, vulnerable systems may expose sensitive kernel-related information. The bundle does not provide CVSS, affected kernel versions, exploit details, or confirmed exploitation.
Executive priority
Prioritize through normal kernel security update processes unless asset criticality is high. The impact is sensitive information disclosure, but urgency cannot be rated confidently because severity, exploitation, and version scope are incomplete in the supplied sources.
Technical view
The CVE describes information disclosure in upstream Linux kernel encrypted-keys, with Android ID A-70526974. Public references include Android Pixel, Ubuntu, Red Hat, and Debian kernel security advisories. The provided data does not specify the exact flaw mechanics, prerequisites, or impacted kernel version ranges.
Likely exposure
Primary exposure is Android kernel builds covered by the Android/Pixel bulletin. Ubuntu, Red Hat, and Debian advisories also reference related Linux kernel updates, but the bundle does not identify exact package versions, kernel branches, device models, or configuration requirements.
Exploitation context
No active exploitation is supported by the supplied data. KEV is false, and the bundle provides no exploit reports, public proof of concept, attack chain, or prerequisite details. Treat exploitation status as unconfirmed rather than absent.
Researcher notes
Key gaps are missing CVSS, CWE, affected kernel ranges, configuration prerequisites, and exploitability detail. Research should focus on correlating Android ID A-70526974 with vendor patches and confirming whether downstream advisories backported the same encrypted-keys fix.
Mitigation direction
- Apply vendor kernel security updates referenced by Android, Ubuntu, Red Hat, and Debian where applicable.
- For Android or Pixel fleets, verify applicable April 2018 security bulletin coverage or later vendor patches.
- If exact exposure is unclear, request vendor guidance for affected kernel versions and backports.
- Test kernel updates against critical workloads before broad production rollout.
Validation and detection
- Inventory Android devices and Linux hosts against the cited vendor advisories.
- Confirm installed kernel builds include the relevant vendor security fixes.
- Check whether affected systems rely on encrypted-keys or related kernel key management features.
- Document unsupported or unpatchable devices for risk acceptance or replacement planning.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-13305 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- USN-3631-2CVE reference · vendor-advisory, x_refsource_UBUNTU
- USN-3631-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- https://source.android.com/security/bulletin/pixel/2018-04-01CVE reference · x_refsource_CONFIRM
- RHSA-2018:2165CVE reference · vendor-advisory, x_refsource_REDHAT
- USN-3655-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- USN-3655-2CVE reference · vendor-advisory, x_refsource_UBUNTU
- [debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security updateCVE reference · mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.