CVE-2018-11296

CVE-2018-11296 is a Qualcomm WLAN Host buffer overflow affecting Android on Pixel/Nexus devices, caused by a buffer overwrite while processing a firmware message in the WLAN handler. The vulnerability is in the Qualcomm WLAN Host within CAF/Linux-based builds. Impact is memory corruption potentia...

CVE-2018-11294

CVE-2018-11294 affects Qualcomm CAF Android WLAN components (WLAN HOST). The issue arises in the WLAN firmware handling, where information for 4 Access Categories (AC) is provided but only the first 3 ACs are copied due to improper conditional logic. This truncation potentially affects the WLAN A...

CVE-2018-11302

CVE-2018-11302 corresponds to a WLAN buffer overflow issue described in Qualcomm CAF Android variants (Android for MSM, Firefox OS for MSM, QRD Android) where input from userspace could be copied into a kernel buffer without proper validation. The CVE is listed under the Qualcomm component mappin...

CVE-2018-11302

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from userspace before copying into buffer can lead to potential array overflow in WLAN...

CVE-2018-11294

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...

CVE-2018-11302: Improper Input Validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from userspace before copying into buffer can lead to potential array overflow in WLAN...

CVE-2018-11840: Double Free

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice...

CVE-2018-11826: Integer Overflow or Wraparound

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...

PT-2018-10843

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an improper length check that can lead to out-of-bounds access in the WLAN function, affecting Android releases that use the Linux kernel. Recommendations At the...

CVE-2018-11296: Out-of-bounds Write

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing a message from firmware in WLAN handler, a buffer overwrite can occur...

CVE-2018-11299: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly in stats events then WLAN host driver tries to access interface array without proper bound check which can lead to invalid memory access and ...

PT-2018-10464

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue arises when the WLAN FW fails to correctly fill the vdev id in stats events,...

CVE-2018-11836: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check can lead to out-of-bounds access in WLAN function...

CVE-2018-11842: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, during wlan association, driver allocates memory. In case the mem allocation fails driver does a mem free though the memory was not allocated...

PT-2018-10461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overwrite issue can occur in the WLAN handler while processing a message from firmware. This issue affects Android releases from CAF using the Linux kernel. Recommendations At t...

PT-2018-10466

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a "Use after free" scenario, where a callback executed from...

CVE-2018-11300: Use After Free

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, callback executed from the other thread has freed memory which is also used in wlan function and may result in to a "Use after free" scenario...

PT-2018-10459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises from improper conditional logic used in the WLAN handler to compare with the maximum number of access categories. This logic results in only the first 3 access category ...

PT-2018-10845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue exists in the WLAN driver command ioctl processing, where a temporary buffer used to construct the reply message may be freed twice. This is present in all Android releases from...

PT-2018-10468

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a lack of input validation from userspace before copying data in...