Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in limCheckRxRSNIeMatch in case incorrect RSNIE is received from the client in assoc request...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in compatibility mode, flashdata from 64-bit userspace may cause disclosure of kernel memory or a fault due to using a userspace-provided address...

CVE-2017-11067

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the Athdiag procfs entry does not have a proper address sanity check which may potentially lead to the use of an out-of-range pointer offset...

CVE-2017-11057

CVE-2017-11057 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel in compatibility mode. The vulnerability arises from flash_data handling in 64-bit userspace, where a userspace-provided address can lead to kernel memory disclosure or a fault. Impact is inf...

CVE-2017-11060

CVE-2017-11060 is a buffer overread vulnerability affecting Android for MSM, Firefox OS for MSM, and QRD Android builds that use CAF Linux kernels. The issue occurs during processing of ACA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST and QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST ven...

CVE-2017-9715

The CVE-2017-9715 entry describes a buffer over-read in Android for MSM, Firefox OS for MSM, QRD Android, and CAF Android releases using the Linux kernel when processing a vendor command. The underlying vulnerability is a buffer over-read (noted as an information disclosure risk) with affected co...

CVE-2017-11051

CVE-2017-11051 affects Android for MSM and related CAF/Linux kernel builds. The root cause is that hb_params in __wlan_hdd_cfg80211_testmode is not zero-initialized, enabling an information-disclosure vulnerability. Impact is described as information disclosure with network attack vector; exploit...

CVE-2017-11054

CVE-2017-11054 affects Android for MSM, Firefox OS for MSM, and QRD Android on CAF Linux kernels. The vulnerability is a buffer over-read triggered when processing a specially crafted cfg80211 vendor command, potentially impacting confidentiality (as per CVSS) and availability. Connected document...

CVE-2017-9717

CVE-2017-9717 affects Android for MSM, Firefox OS for MSM, and QRD Android builds based on CAF Linux kernel, where Netlink attribute parsing can trigger a buffer overread in WLAN-related code. The vulnerability is described across multiple sources as a buffer overread that may impact confidential...

CVE-2017-11063

CVE-2017-11063 describes a race condition between two userspace processes that interact with a driver in Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF/Linux kernel. The race condition can lead to a null pointer dereference, i.e., a potential crash; exploitation details, af...

CVE-2017-11062

CVE-2017-11062 describes a potential buffer overread in WLAN handling on Android/CAF/Linux kernel builds due to unvalidated attributes in __wlan_hdd_cfg80211_do_acs. Affected products include Android for MSM, Firefox OS for MSM, QRD Android, and CAF Linux kernel releases across Android versions. ...

CVE-2017-11064

CVE-2017-11064 is a WLAN vulnerability affecting Android for MSM (and variants) where a buffer overread occurs while processing ACA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST and QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST in __wlan_hdd_cfg80211_set_passpoint_list and hdd_extscan_pas...

CVE-2017-11046

CVE-2017-11046 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The issue arises when an audio driver ioctl handler is invoked, potentially triggering a kernel out-of-bounds write. Publicly available details in the connected sources reiterate the same r...

CVE-2017-11067

CVE-2017-11067 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability stems from an improper address sanity check in the Athdiag procfs entry, which may allow an out-of-range pointer offset. This is a local issue with a low attacker profile ...

CVE-2017-11064

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed during processing of ACANL80211VENDORSUBCMDEXTSCANPNOSETPASSPOINTLIST and QCANL80211VENDORSUBCMDEXTSCANPNOSETLIST cfg80211 vendor commands in...

CVE-2017-11053

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of length less than 16 is received in association response or in qos map configure action frame, a buffer overflow can potentially occur in ConvertQosMapsetFrame...

CVE-2017-11056

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while doing sha and cipher operations, a userspace buffer is directly accessed in kernel space potentially leading to a page fault...

CVE-2017-11061

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing cfg80211 vendor sub command QCANL80211VENDORSUBCMDROAM, a buffer over-read can occur...

CVE-2017-9714

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in limCheckRxRSNIeMatch in case incorrect RSNIE is received from the client in assoc request...

CVE-2017-9687

CVE-2017-9687 involves a race between two concurrent threads/processes in Android for MSM (and related CAF/Linux kernel builds) where they can write the value "0" to a debugfs file that controls ipa ipc log. This can lead to a double-free in ipc_log_context_destroy() and a Use-After-Free when the...