CVE-2018-5843

In the function wmapdevdivinfoevthandler in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, there is no upper bound check on the value event-numchainsvalid received from firmware which can lead to a buffer overwrite of the fixed size...

CVE-2018-3579

The CVE-2018-3579 issue affects the WLAN driver in CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The root cause is that event->num_entries_in_page, a value received from firmware, is not properly validated, which can lead to a buffer over-read...

CVE-2017-15843

CVE-2017-15843 describes a race condition in the Qualcomm bus driver, specifically msm_bus_floor_vote_context(), which can lead to a double-free in CAF Android-for-MSM builds on Linux kernels. The vulnerability affects Android releases that use the affected bus driver; CVSS data indicates Local a...

CVE-2017-15854

The value of fixparam-numchans is received from firmware and if it is too large, an integer overflow can occur in wmaradiochanstatseventhandler for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android usin...

CVE-2018-3571

Summary: CVE-2018-3571 affects the Qualcomm KGSL driver used in Android CAF/Linux kernel releases. The vulnerability is a Use-After-Free condition that can occur when printing information about sparse memory allocations. Impact (as described): Local attacker could potentially cause memory corrupt...

Buffer overflow

While sending a probe request indication in limsendsmeprobereqind in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, a buffer overflow can occur...

Design/Logic Flaw

Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

Race condition

A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPAIOCNOTIFYWANUPSTREAMROUTEADD/IPAIOCNOTIFYWANUPSTREAMROUTEDEL/IPAIOCNOTIFYWANEMBMSCONNECTED are called in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5846

A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPAIOCNOTIFYWANUPSTREAMROUTEADD/IPAIOCNOTIFYWANUPSTREAMROUTEDEL/IPAIOCNOTIFYWANEMBMSCONNECTED are called in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5841

dcccurrlist is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid access in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-3580

CVE-2018-3580 describes a stack-based buffer overflow in the WLAN driver when the pmkid_count exceeds the PMKIDCache size on CAF Android (Android for MSM, Firefox OS for MSM, QRD Android) builds using the Linux kernel. The issue affects all such Android releases and relates to the PMKID cache siz...

CVE-2018-3565

CVE-2018-3565 affects Qualcomm WLAN/CAF Android devices where lim_send_sme_probe_req_ind() in the WLAN stack of the Linux kernel can overflow a buffer during probe request indication. The issue is documented across multiple sources as a buffer overflow in the Android CAF/Linux kernel path used fo...

CVE-2018-3562

CVE-2018-3562: A buffer over-read can occur while processing a FILS authentication frame in Android CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Documented in NVD as a DoS vulnerability within WLAN, with local attack vector and availability impact. Affected: Andr...

CVE-2018-3565

While sending a probe request indication in limsendsmeprobereqind in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, a buffer overflow can occur...

The vulnerability of the `wma_send_bcn_buf_ll` function in the Android WLAN operating system component from the CAF repository allows a hacker to execute arbitrary code.

The vulnerability of the wmasendbcnbufll function in the Android WLAN operating system component from the CAF repository is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the context of a privileged process,...

The vulnerability of the Android wireless network driver from the CAF repository, which allows a hacker to cause a service failure.

The vulnerability of the Android wireless network driver from the CAF repository is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the `wma_unified_link_peer_stats_event_handler` function in the Android WLAN operating system component from the CAF repository allows a perpetrator to execute arbitrary code.

The vulnerability of the wmaunifiedlinkpeerstatseventhandler function in the Android WLAN operating system from the CAF repository is caused by buffer overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the context of a privileged process, using a...

The vulnerability of the wma_nlo_match_evt_handler function in the Android WLAN operating system from the CAF repository allows a attacker to execute arbitrary code.

The vulnerability of the wmanlomatchevthandler function in the Android WLAN operating system from the CAF repository is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code within a privileged...

The vulnerability of the `wma_unified_bcntx_status_event_handler` function in the Android WLAN operating system component from the CAF repository allows a perpetrator to execute arbitrary code.

The vulnerability of the wmaunifiedbcntxstatuseventhandler function in the Android WLAN operating system from the CAF repository involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code within a privileged proces...

The vulnerability of the oemcmd_handler function in the Android operating system’s WLAN component from the CAF repository allows a hacker to disclose protected information.

The vulnerability of the oemcmdhandler function in the Android operating system’s WLAN component from the CAF repository is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information using a...