CVE-2017-18159

CVE-2017-18159 affects CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue is an out-of-bounds access when processing a StrHwPlatform whose length is smaller than EFICHIPINFO_MAX_ID_LENGTH, leading to a local, high-severity impact (CVSS 2.0/3.0:...

CVE-2017-18159

In Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, while processing a StrHwPlatform with length smaller than EFICHIPINFOMAXIDLENGTH, an array out of bounds access may occur...

CVE-2018-5898

CVE-2018-5898 describes an integer overflow in the function msm_pcm_adsp_stream_cmd_put() within CAF Android for MSM Linux kernel code before the 2018-06-05 patch level. If user-supplied param_length exceeds a limit, the issue can affect local confidentiality, integrity, and availability (high im...

CVE-2018-5832

CVE-2018-5832 infers a race condition in a camera driver ioctl handler on CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The root cause is a Use-After-Free condition triggered by a race in the driver path prior to the security patch level 2018-06-05....

CVE-2017-14893

While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image header size + total image header entry in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android...

CVE-2018-3597

In the ADSP RPC driver in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, an arbitrary kernel write can occur...

CVE-2017-14893

CVE-2017-14893 involves a potential buffer over-read during flashing a meta image in Android CAF builds (Android for MSM, Firefox OS for MSM, QRD Android) via the Linux kernel, before the 2018-06-05 patch level. Root cause: image size smaller than the image header or header plus header entries tr...

CVE-2018-5887

CVE-2018-5887 affects Android builds from CAF using the Linux kernel, where processing the USB StrSerialDescriptor array can trigger an array index out-of-bounds. The issue is tied to Android for MSM, Firefox OS for MSM, and QRD Android releases prior to the 2018-06-05 security patch level. The C...

CVE-2018-5829

The CVE-2018-5829 issue affects the WLAN stack in Android for MSM CAF builds (Linux kernel) and specifically the function wlan_hdd_cfg80211_set_privacy_ibss(). The vulnerability is a buffer over-read reported in Android releases using the affected CAF Linux kernel prior to the 2018-06-05 security...

CVE-2017-15824

In Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, the function UpdateDeviceStatus writes a local stack buffer without initialization to flash memory using WriteToPartition which may potentially leak memory...

CVE-2017-14872

While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-3564

CVE-2018-3564 affects the FastRPC driver in CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue is a Use-After-Free when mapping on the remote processor fails, potentially impacting components such as DSP_Services. The description notes that thi...

CVE-2018-5896

CVE-2018-5896 affects Android CAF builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) prior to the 2018-06-05 security patch level. The issue is a kernel panic caused by an out-of-bounds read from not checking the source buffer length against the packet stream length ...

CVE-2018-5899

CVE-2018-5899 affects Android CAF builds (Android for MSM, Firefox OS for MSM, QRD Android) with the Linux kernel used in these releases. A use-after-free occurs in the TDLS path: netbuf is freed in ol_tx_completion_handler and subsequently accessed by NBUF_UPDATE_TX_PKT_COUNT. This use-after-fre...

CVE-2018-5830

CVE-2018-5830 describes a potential buffer overflow in the Android CAF/Linux kernel stack when processing the HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND message, affecting Android for MSM, Firefox OS for MSM, and QRD Android builds prior to the 2018-06-05 patch level. Root cause is a buffer overflow in t...

CVE-2018-5831

CVE-2018-5831 affects the KGSL driver in CAF Android builds that use the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The vulnerability stems from a reference counting error that can trigger a Use-After-Free condition. The impact is described in the Android/CAF context as a lo...

CVE-2018-3597

CVE-2018-3597 affects the ADSP RPC driver in Android CAF builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). Before the 2018-06-05 security patch level, this issue could allow an arbitrary kernel write via a local attack on vulnerable devices. The CVSS metrics in the...

CVE-2018-3577

CVE-2018-3577 affects Qualcomm WLAN within Android CAF builds (Android for MSM, etc.) prior to the 2018-06-05 patch level. The issue arises while processing fragments: when fragment count is very large, an integer overflow can cause a buffer overflow. The vulnerability is documented in multiple s...

CVE-2018-5835

CVE-2018-5835 describes a potential buffer overflow in the Android WLAN stack: when seq_len exceeds CSR_MAX_RSC_LEN, copying keyRSC in __wlan_hdd_cfg80211_add_key() may overflow. This affects Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The ...

CVE-2018-5888

While processing the system path, an out of bounds access can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...