LiveActive security incident?Get immediate response
CVE Record

CVE-2017-13322: In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergen...

In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error in the code. This could lead to a local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This Android issue could let an unprivileged local actor disrupt access to emergency calling through a logic error. The business concern is safety and availability, not data theft. The public bundle rates it critical, but affected-version detail is sparse.

Executive priority

Treat as urgent for managed Android fleets because emergency service availability is safety-critical. Prioritize patch verification over broad incident response unless new evidence shows exploitation.

Technical view

The record names PhoneInterfaceManager.java endCallForSubscriber and CWE-783. It describes a local denial of service requiring no extra privileges and no user interaction, with possible prevention of emergency services access. The bundle references Google’s Pixel May 2018 bulletin.

Likely exposure

Exposure appears limited to Android or Pixel builds covered by Google’s May 2018 bulletin. The provided affected data says Android Kernel but does not list exact Android versions, device models, or OEM downstream status.

Exploitation context

The bundle does not cite active exploitation, and KEV is false. It describes local denial of service without user interaction or additional privileges. No public exploit steps are provided in the supplied sources.

Researcher notes

Evidence is incomplete on exact affected versions and remediation details. The CVSS vector in the bundle shows network attack complexity, while the description says local denial of service; preserve that discrepancy in tracking notes.

Mitigation direction

  • Check Google and OEM guidance for CVE-2017-13322 coverage.
  • Apply Android or Pixel security updates that include this CVE.
  • Prioritize devices used in safety-critical or field operations.
  • Retire or isolate unsupported Android devices lacking relevant updates.

Validation and detection

  • Inventory Android devices and recorded security patch levels.
  • Map device builds against Google and OEM bulletins for this CVE.
  • Confirm MDM compliance policies require relevant Android security updates.
  • Do not validate by attempting to disrupt emergency calling on production devices.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-783: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-13322 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE score

Vulnerability scoring details

Base CVSS 4.0 score

10Critical
CVSS 4.0 vector shape for CVE-2017-13322Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleAndroidAndroid Kernelunaffected
Weakness

CWE details

CWE-783

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-783 · source CWE mapping

Operator Precedence Logic Error

Operator Precedence Logic Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs