An integer overflow in the BnAudioPolicyService::onTransact function in frameworks can be exploited to achieve media_server permission. All versions below Lollipop 5.1 are affected.