CVE-2017-9716

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qbt1000 driver implements an alternative channel for usermode applications to talk to QSEE applications...

CVE-2017-11005

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during a deinitialization path...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary unmap in MediaServer...

CVE-2017-14908

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the SafeSwitch test application does not properly validate the number of blocks to verify...

CVE-2017-9716

CVE-2017-9716 affects the Qualcomm Qbt1000 driver (Qualcomm components) in Android for MSM and related CAF-based kernels. The vulnerability is described as an Elevation of Privilege (EoP) issue, with CVE records (NVD, CVELIST, CNVD) confirming the driver as the vulnerable component and noting an ...

CVE-2017-14895

CVE-2017-14895 affects Android for MSM/CAF builds using the Linux kernel. After a subsystem reset, the iwpriv interface does not report accurate information. The vulnerability is triggered locally (LOCAL) with low attack complexity and requires no authentication, potentially impacting confidentia...

CVE-2017-14904

CVE-2017-14904 affects Android’s libgralloc/MediaServer path. A crafted binder request can cause an arbitrary unmap in MediaServer, enabling sandbox escape and, per ThreatPost, could allow code injection into system_server via a malicious URL in Chrome. Exploitation details in sources describe an...

CVE-2017-14917

CVE-2017-14917 affects Android ecosystems (Android for MSM, Firefox OS for MSM, QRD Android) with CAF Linux kernel variants. The issue stems from improper validation of buffer sizes in the message passing interface, enabling potential exploitation via crafted inputs. The CVSS data indicates a cri...

CVE-2017-14897

The CVE-2017-14897 entry corresponds to a local privilege-elevation flaw in the RPMB/CAF kernel path used by Android on MSM/CAF builds. The described issue is that, while handling QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND, a userspace buffer is directly accessed from kernel space, enabling local explo...

CVE-2017-9700

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer overwrite is possible in fwnamestore if image name is 64 characters...

CVE-2017-9722

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID hdmitxsysfswtaedid, if edidsize, which is controlled by userspace, is too large, a buffer overflow occurs...

CVE-2017-9718

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALE vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALE contains fewer than 1 byte, a buffer overrun occurs...

CVE-2017-11044

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID hdmitxsysfswtaedid, if edidsize, which is controlled by userspace, is too large, a buffer overflow occurs...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a graphics driver ioctl handler, the lack of copyfromuser function calls may result in writes to kernel memory...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts which can result in buffer overflow of msg cache...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the SENDACTIONFRAME IOCTL, a buffer over-read can occur if the payload length is less than 7...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition...