PT-2018-10897

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a lack of length validation check for a value received from a caller function used as an array index for WMA interfaces in the WLAN HOST, which can lead to an...

PT-2018-10892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an improper length check validation in the WLAN function, which can cause the driver to write default RSN capabilities to memory not allocated to the frame. This...

CVE-2018-11878: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, possibility of invalid memory access while processing driver command in WLAN function...

CVE-2018-11891: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on the length of array while accessing can lead to an out of bound read in WLAN HOST function...

PT-2018-10879

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns a possibility of invalid memory access while processing a driver command in the WLAN function. This affects Android releases, including Android for MSM, Firefox OS for...

CVE-2018-11903: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from caller function used as an array index for WMA interfaces can lead to OOB write in WLAN HOST...

PT-2018-10884

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue occurs when the mode parameter in the wlan function is given an out of bound...

PT-2018-10887

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue occurs when requesting RSSI timeout in the Linux kernel used by Android releases, potentially leading to access of invalid memory. This happens because the local variable...

PT-2018-10896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a lack of length validation check for a value received from firmware, which can lead to out-of-bounds OOB access in the WLAN HOST. This affects Android releases,...

CVE-2018-11886: Integer Overflow or Wraparound

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check while calculating the MPDU data length will cause an integer overflow and then to buffer overflow in WLAN function...

CVE-2018-11902: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to OOB access in WLAN HOST...

CVE-2018-11895: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check Validation in WLAN function can lead to driver writes the default rsn capabilities to the memory not allocated to the frame...

PT-2018-10886

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is caused by a lack of check while calculating the MPDU data length, resulting in an integer overflow and subsequently a buffer overflow in the WLAN function. This affects all...

CVE-2018-11836

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check can lead to out-of-bounds access in WLAN function...

CVE-2018-11840

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice...

CVE-2018-11302

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from userspace before copying into buffer can lead to potential array overflow in WLAN...

CVE-2018-11826

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...

CVE-2018-11299

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly in stats events then WLAN host driver tries to access interface array without proper bound check which can lead to invalid memory access and ...

CVE-2018-11300

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, callback executed from the other thread has freed memory which is also used in wlan function and may result in to a "Use after free" scenario...

CVE-2018-11294

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...