CVE-2018-3574

CVE-2018-3574 describes a vulnerability in CAF Android kernel userspace cache maintenance for ION buffers where the ION_FLAG_SECURE flag is not set, causing the kernel to perform cache maintenance on memory that does not belong to HLOS. The provided sources (NVD entry and Debian/Ubuntu security t...

CVE-2018-11889

CVE-2018-11889 affects Android builds using CAF WLAN (Android for MSM, etc.) that rely on the Linux kernel. The vulnerability arises when requesting RSSI timeout, where the local variable context in a WLAN function is freed, potentially leading to access to invalid memory. This could enable memor...

CVE-2018-11902

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to OOB access in WLAN HOST...

CVE-2018-11889

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when requesting rssi timeout, access invalid memory may occur since local variable 'context' stack data of wlan function is free...

CVE-2018-11894

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing preferred network offload scan results integer overflow may lead to buffer overflow when large frame length is received from FW...

CVE-2018-11886

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check while calculating the MPDU data length will cause an integer overflow and then to buffer overflow in WLAN function...

CVE-2018-11886

CVE-2018-11886 affects Qualcomm WLAN host in Android CAF/linux-kernel WLAN stack. Root cause: missing validation when calculating MPDU data length leads to an integer overflow, then a buffer overflow in the WLAN function. Impact per sources is consistent with local, low-privilege exploitation and...

CVE-2018-11902

CVE-2018-11902 affects Qualcomm WLAN host components in Android CAF builds; root cause is lack of length validation for a value received from firmware, leading to out-of-bounds access in WLAN HOST. The CVE is listed with High severity (per Qualcomm’s 2019-10-05 bulletin grouping for WLAN host). N...

CVE-2018-11904

CVE-2018-11904 is a null pointer dereference vulnerability in the Android WLAN stack (CAF/Linux kernel) where asynchronous callbacks may dereference a caller’s local pointer if the caller times out. This enables a local attacker to cause a denial of service. Public connected documents corroborate...

CVE-2018-3574

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, userspace can request ION cache maintenance on a secure ION buffer for which the IONFLAGSECURE ion flag is not set and cause the kernel to attempt to perform cache maintenance on memory which...

CVE-2018-11897

The CVE-2018-11897 entry concerns CAF Android/Linux kernel WLAN code. Affected: Android releases (Android for MSM, Firefox OS for MSM, QRD Android) using CAF’s Linux kernel. The issue occurs while processing a diag event after connecting to a network, where an out-of-bounds read can occur if the ...

CVE-2018-3573

CVE-2018-3573 is listed under Qualcomm components as a Bootloader issue. Connected data indicate a vulnerability in the Qualcomm bootloader affecting Android variants (CAF) where, during relocation of kernel images from a crafted boot image, an out-of-bounds access can occur. The sources also pla...

CVE-2018-11895

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check Validation in WLAN function can lead to driver writes the default rsn capabilities to the memory not allocated to the frame...

CVE-2018-11898

CVE-2018-11898 affects Qualcomm WLAN host components in CAF Android builds (Android for MSM/CAF Linux kernel). The issue is an out-of-bounds read when processing a start BSS request if the SSID length exceeds the maximum, leading to potential memory access violations. The NVD entry and related re...

CVE-2018-11897

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing diag event after associating to a network out of bounds read occurs if ssid of the network joined is greater than max limit...

CVE-2018-11860

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length...

CVE-2018-11852

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write...

CVE-2018-11868

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to buffer overflow in nan response event handler...

CVE-2018-11843

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack fo check on return value in WMA response handler can lead to potential use after free...

CVE-2018-11826

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...