Out-of-bounds

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while relocating kernel images with a specially crafted boot image, an out of bounds access can occur...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, userspace can request ION cache maintenance on a secure ION buffer for which the IONFLAGSECURE ion flag is not set and cause the kernel to attempt to perform cache maintenance on memory which...

Integer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check while calculating the MPDU data length will cause an integer overflow and then to buffer overflow in WLAN function...

CVE-2018-11889

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when requesting rssi timeout, access invalid memory may occur since local variable 'context' stack data of wlan function is free...

Input validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from caller function used as an array index for WMA interfaces can lead to OOB write in WLAN HOST...

Race condition

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a race condition while accessing num of clients in DIAG services can lead to out of boundary access...

CVE-2018-11886

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check while calculating the MPDU data length will cause an integer overflow and then to buffer overflow in WLAN function...

CVE-2018-11895

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check Validation in WLAN function can lead to driver writes the default rsn capabilities to the memory not allocated to the frame...

CVE-2018-11897

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing diag event after associating to a network out of bounds read occurs if ssid of the network joined is greater than max limit...

CVE-2018-11902

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to OOB access in WLAN HOST...

CVE-2018-11904

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, asynchronous callbacks received a pointer to a callers local variable. Should the caller return early e.g., timeout, the callback will dereference an invalid pointer...

CVE-2018-3573

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while relocating kernel images with a specially crafted boot image, an out of bounds access can occur...

CVE-2018-11894

CVE-2018-11894 is listed in Qualcomm WLAN HOST components with High severity. The provided documents indicate the issue arises from an integer overflow while processing preferred network offload scan results, which may lead to a buffer overflow when a large frame length is received from the firmw...

CVE-2018-11893

CVE-2018-11893 is a vulnerability in CAF-based Android WLAN code (Linux kernel) where processing a vendor scan request can overflow a buffer when the input length of request IEs exceeds the maximum. The issue is documented across multiple Android CAF releases (Android for MSM, Firefox OS for MSM,...

CVE-2018-11898

CVE-2018-11898 affects Qualcomm WLAN host components in CAF Android builds (Android for MSM/CAF Linux kernel). The issue is an out-of-bounds read when processing a start BSS request if the SSID length exceeds the maximum, leading to potential memory access violations. The NVD entry and related re...

CVE-2018-11897

The CVE-2018-11897 entry concerns CAF Android/Linux kernel WLAN code. Affected: Android releases (Android for MSM, Firefox OS for MSM, QRD Android) using CAF’s Linux kernel. The issue occurs while processing a diag event after connecting to a network, where an out-of-bounds read can occur if the ...

CVE-2018-11902

CVE-2018-11902 affects Qualcomm WLAN host components in Android CAF builds; root cause is lack of length validation for a value received from firmware, leading to out-of-bounds access in WLAN HOST. The CVE is listed with High severity (per Qualcomm’s 2019-10-05 bulletin grouping for WLAN host). N...

CVE-2018-11904

CVE-2018-11904 is a null pointer dereference vulnerability in the Android WLAN stack (CAF/Linux kernel) where asynchronous callbacks may dereference a caller’s local pointer if the caller times out. This enables a local attacker to cause a denial of service. Public connected documents corroborate...

CVE-2018-3574

CVE-2018-3574 describes a vulnerability in CAF Android kernel userspace cache maintenance for ION buffers where the ION_FLAG_SECURE flag is not set, causing the kernel to perform cache maintenance on memory that does not belong to HLOS. The provided sources (NVD entry and Debian/Ubuntu security t...

CVE-2018-3573

CVE-2018-3573 is listed under Qualcomm components as a Bootloader issue. Connected data indicate a vulnerability in the Qualcomm bootloader affecting Android variants (CAF) where, during relocation of kernel images from a crafted boot image, an out-of-bounds access can occur. The sources also pla...