CVE-2017-18070

CVE-2017-18070 describes a vulnerability in Qualcomm WLAN on Android (CAF) where, in the function wma_ndp_end_response_event_handler() , the local variable len_end_rsp (uint32) can overflow if event->num_ndp_end_rsp_per_ndi_list is very large. This overflow can lead to a heap overwrite of the ...

CVE-2017-15857

CVE-2017-15857 is an out-of-bounds access vulnerability in the camera driver of Android CFAs (Android for MSM, Firefox OS for MSM, QRD Android) linked to an error when copying region params from user space in the Linux kernel. Affected product area: camera subsystem/kernell driver in Android rele...

CVE-2018-5851

CVE-2018-5851 is a Qualcomm WLAN buffer-overflow vulnerability affecting Android devices (Pixel/Nexus) due to HTT_T2H_MSG_TYPE_TX_COMPL_IND processing with an out-of-range num_msdus. The issue can allow arbitrary code execution or a DoS. Public details map this CVE to Qualcomm WLAN in the May 201...

CVE-2018-3581

The CVE concerns the WLAN driver in CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) on Linux kernel platforms. The issue is a buffer overwrite that occurs when the vdev_id received from firmware exceeds max_bssid. This is described across multiple sources (NVD entry CVE-2018...

CVE-2018-5849

CVE-2018-5849 affects Qualcomm QTEECOM driver on Android (CAF) where a race condition when multiple HLOS clients load the same TA can cause a Use-After-Free, enabling Elevation of Privilege. Documented impact is EoP with High/Partial confidentiality/integrity/availability implications; CVSSv3 bas...

CVE-2018-5848

CVE-2018-5848 concerns the Linux kernel function wmi_set_ie(), where unsigned integer overflow in length validation can lead to a buffer overflow when processing the ie_len argument. The description across connected Nessus entries ties this to memory corruption and potential system crash, affecti...

CVE-2018-5847

CVE-2018-5847 describes a use-after-free condition arising from early/late retirement of rotation requests in CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Affected software is Android CAF kernel components; the underlying issue is a memory-managem...

CVE-2017-15843

CVE-2017-15843 describes a race condition in the Qualcomm bus driver, specifically msm_bus_floor_vote_context(), which can lead to a double-free in CAF Android-for-MSM builds on Linux kernels. The vulnerability affects Android releases that use the affected bus driver; CVSS data indicates Local a...

CVE-2018-3571

Summary: CVE-2018-3571 affects the Qualcomm KGSL driver used in Android CAF/Linux kernel releases. The vulnerability is a Use-After-Free condition that can occur when printing information about sparse memory allocations. Impact (as described): Local attacker could potentially cause memory corrupt...

CVE-2018-5843

In the function wmapdevdivinfoevthandler in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, there is no upper bound check on the value event-numchainsvalid received from firmware which can lead to a buffer overwrite of the fixed size...

CVE-2017-15854

The value of fixparam-numchans is received from firmware and if it is too large, an integer overflow can occur in wmaradiochanstatseventhandler for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android usin...

CVE-2018-3579

The CVE-2018-3579 issue affects the WLAN driver in CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The root cause is that event->num_entries_in_page, a value received from firmware, is not properly validated, which can lead to a buffer over-read...

Buffer overflow

While sending a probe request indication in limsendsmeprobereqind in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, a buffer overflow can occur...

Design/Logic Flaw

Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

Race condition

A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPAIOCNOTIFYWANUPSTREAMROUTEADD/IPAIOCNOTIFYWANUPSTREAMROUTEDEL/IPAIOCNOTIFYWANEMBMSCONNECTED are called in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5841

dcccurrlist is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid access in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5846

A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPAIOCNOTIFYWANUPSTREAMROUTEADD/IPAIOCNOTIFYWANUPSTREAMROUTEDEL/IPAIOCNOTIFYWANEMBMSCONNECTED are called in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-3580

CVE-2018-3580 describes a stack-based buffer overflow in the WLAN driver when the pmkid_count exceeds the PMKIDCache size on CAF Android (Android for MSM, Firefox OS for MSM, QRD Android) builds using the Linux kernel. The issue affects all such Android releases and relates to the PMKID cache siz...

CVE-2018-3565

CVE-2018-3565 affects Qualcomm WLAN/CAF Android devices where lim_send_sme_probe_req_ind() in the WLAN stack of the Linux kernel can overflow a buffer during probe request indication. The issue is documented across multiple sources as a buffer overflow in the Android CAF/Linux kernel path used fo...

CVE-2018-3562

CVE-2018-3562: A buffer over-read can occur while processing a FILS authentication frame in Android CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Documented in NVD as a DoS vulnerability within WLAN, with local attack vector and availability impact. Affected: Andr...