CVE-2017-11063

CVE-2017-11063 describes a race condition between two userspace processes that interact with a driver in Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF/Linux kernel. The race condition can lead to a null pointer dereference, i.e., a potential crash; exploitation details, af...

CVE-2017-9686

The CVE-2017-9686 issue affects the Qualcomm SPS driver in Android environments (CAF/Linux kernel variants that include Android for MSM/CAF). Root cause is a double free/use-after-free in the SPS driver when debugfs logging is enabled. Reported impact includes local access with partial confidenti...

CVE-2017-11062

CVE-2017-11062 describes a potential buffer overread in WLAN handling on Android/CAF/Linux kernel builds due to unvalidated attributes in __wlan_hdd_cfg80211_do_acs. Affected products include Android for MSM, Firefox OS for MSM, QRD Android, and CAF Linux kernel releases across Android versions. ...

CVE-2017-9683

CVE-2017-9683 describes an integer overflow in Android for MSM/CAF Linux kernel when flashing a meta image if user-supplied image offset/size are too large. Affected: Android for MSM, Firefox OS for MSM, QRD Android with CAF Linux kernel (all CAF-based Android releases). Root cause: integer overf...

CVE-2017-11046

CVE-2017-11046 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The issue arises when an audio driver ioctl handler is invoked, potentially triggering a kernel out-of-bounds write. Publicly available details in the connected sources reiterate the same r...

CVE-2017-11067

CVE-2017-11067 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability stems from an improper address sanity check in the Athdiag procfs entry, which may allow an out-of-range pointer offset. This is a local issue with a low attacker profile ...

CVE-2017-11067

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the Athdiag procfs entry does not have a proper address sanity check which may potentially lead to the use of an out-of-range pointer offset...

CVE-2017-9683

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, an integer overflow can occur, if user-defined image offset and size values are too large...

CVE-2017-9686

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double free/use after free in the SPS driver when debugfs logging is used...

CVE-2017-11051

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is possible in function wlanhddcfg80211testmode since buffer hbparams is not initialized to zero...

CVE-2017-11052

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted QCANL80211VENDORSUBCMDNDP cfg80211 vendor command a buffer over-read can occur...

CVE-2017-11054

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur...

CVE-2017-11062

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently attributes are not validated in wlanhddcfg80211doacs which can potentially lead to a buffer overread...

CVE-2017-11046

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when an audio driver ioctl handler is called, a kernel out-of-bounds write can potentially occur...

CVE-2017-11048

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a display driver function, a Use After Free condition can occur...

CVE-2017-9706

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an array out-of-bounds access can potentially occur in a display driver...

CVE-2017-9714

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in limCheckRxRSNIeMatch in case incorrect RSNIE is received from the client in assoc request...

CVE-2017-9715

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a vendor command, a buffer over-read can occur...

CVE-2017-9687

CVE-2017-9687 involves a race between two concurrent threads/processes in Android for MSM (and related CAF/Linux kernel builds) where they can write the value "0" to a debugfs file that controls ipa ipc log. This can lead to a double-free in ipc_log_context_destroy() and a Use-After-Free when the...

CVE-2017-11064

CVE-2017-11064 is a WLAN vulnerability affecting Android for MSM (and variants) where a buffer overread occurs while processing ACA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST and QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST in __wlan_hdd_cfg80211_set_passpoint_list and hdd_extscan_pas...