CVE-2017-9693

CVE-2017-9693 describes a local vulnerability in Android for MSM, Firefox OS for MSM, and QRD Android where the length of the STA_EXT_CAPABILITY attribute value is shorter than StaParams.extn_capability, causing a memcpy from params->ext_capab to StaParams.extn_capability to read extra bytes. ...

CVE-2017-15859

CVE-2017-15859 is a buffer overrun in the Qualcomm Atheros WLAN stack (qcacld-2.0), triggered when QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB carries fewer than 1 byte in the TXPOWER_SCALE_DECR_DB attribute. Affected: Android for MSM, Firefox OS for MSM, and QRD Android devices prior to ...

CVE-2017-9723

The touchscreen driver synapticsdsx in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-05, the size of a stack-allocated buffer can be set to a value which exceeds the size of the stack...

CVE-2017-17769

CVE-2017-17769 involves information leakage in the Qualcomm component (MSM audio driver; listed as qdsp6v2 in the Pixel bulletin) affecting Android for MSM and related builds. The vulnerability is an information-disclosure issue with confidentiality impact (NVD CVSS3: HIGH, base 5.5) and is categ...

CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-14877

While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPAIOCQUERYRTTBLINDEX while another sends an ioctl cmd IPAIOCDELRTRULE, a use-after-free conditi...

CVE-2017-14876

The CVE-2017-14876 vulnerability affects Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-06-21. The root cause is a lack of bounds checking on params->entries[i].vfe_intf in msm_ispif_config_stereo(), which can lead to a kernel out-of-bounds write. Exploitation status is not...

CVE-2017-14881

CVE-2017-14881 describes a use-after-free in the IPA IOCTL handler (IPA_IOC_ADD_HDR_PROC_CTX) on Android for MSM/Firefox OS for MSM/QRD Android prior to 2017-10-13. The vulnerability is in the ipa driver (Qualcomm) and is categorized in the Android Pixel bulletin as an Elevation of Privilege issu...

CVE-2017-15852

CVE-2017-15852 is an information-disclosure vulnerability affecting Qualcomm MSM camera components, specifically an ISPIF/base address exposure in the camera driver (Framebuffer path referenced in Pixel/Qualcomm mappings). The NVD entry describes an information leak of the ISPIF base address that...

CVE-2017-9693

The length of attribute value for STAEXTCAPABILITY in wlanhddchangestation in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-06 being less than the actual lenth of StaParams.extncapability results in a read for extra bytes when a memcpy is done from params-extcapab to...

CVE-2017-15823

The CVE-2017-15823 entry affects Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, where spectral_create_samp_msg() may mishandle firmware values, potentially causing a buffer overflow. The description notes improper validation of firmware values as the root cause. No exploi...

CVE-2017-17766

CVE-2017-17766 affects Android/Qualcomm wireless components (MSM stack) and is caused by insufficient validation of num_peers received from firmware, enabling an integer overflow in the buffer allocation size and potentially leading to a buffer overflow. Affected products include Android for MSM,...

CVE-2017-14881

While calling the IPA IOCTL handler for IPAIOCADDHDRPROCCTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, a use-after-free condition may potentially occur...

CVE-2017-14883

In the function wmaunifiedpowerdebugstatseventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if the value parambuf-numdebugregister received from the FW command buffer is close to max of uint32, then the computation performed using this variable to calculate...

CVE-2017-14875

CVE-2017-14875 describes a heap overread in the ioctl handler VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE used by Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-05-23. The provided documents name the affected environments and the general vulnerability class but do not provide further root...

CVE-2017-14876

In msmispifconfigstereo in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params-entriesi.vfeintf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write...

CVE-2017-14877

CVE-2017-14877 affects the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-08-31. Root cause: there is no mutex lock around allocated memory when processing IOCTLs, enabling a use-after-free if IPA_IOC_QUERY_RT_TBL_INDEX and IPA_IOC_DEL_RT_RULE are issued concurre...

CVE-2017-14892

In the function msmpcmhwparams in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asmopensharedio is not checked properly potentially leading to a possible dangling pointer access...

CVE-2017-9723

CVE-2017-9723 affects the synaptics_dsx touchscreen driver used in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-06-05. The issue arises because a stack-allocated buffer size can be set to exceed the size of the stack, enabling a stack-based overflow. The connected documents ...

Information disclosure

In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory address is passed from userspace through irisvidiocsextctrls ioctl, it will print kernel address data. A user could set it to an arbitrary kern...