CVE-2018-3574

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, userspace can request ION cache maintenance on a secure ION buffer for which the IONFLAGSECURE ion flag is not set and cause the kernel to attempt to perform cache maintenance on memory which...

CVE-2018-11895

CVE-2018-11895 involves Qualcomm WLAN HOST components in Android CAF/linux-based WLAN stack. The available documents indicate a root cause of an improper length check in a WLAN function, which can cause the driver to write the default RSN capabilities into memory not allocated for the frame. The ...

CVE-2018-11883

CVE-2018-11883 affects CAF-based Android WLAN implementations (Android for MSM, Firefox OS for MSM, QRD Android) running in the Linux kernel. The issue arises in the policy manager unit test: if the mode parameter in the WLAN function is out of bounds, it can trigger an out-of-bounds access when ...

CVE-2018-11891

CVE-2018-11891 is a high-severity issue affecting Qualcomm WLAN HOST code linked to CAF Android/Linux WLAN components. The vulnerability stems from a missing bounds check on array length in the WLAN HOST path, potentially enabling an out-of-bounds read in affected devices. Connected sources corro...

CVE-2018-11818

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, LUT configuration is passed down to driver from userspace via ioctl. Simultaneous update from userspace while kernel drivers are updating LUT registers can lead to race condition...

Code injection

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Venus HW searches for start code when decoding input bit stream buffers. If start code is not found in entire buffer, there is over-fetch beyond allocation length. This leads to page fault...

Double free

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe...

Out-of-bounds

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing a gpt update, an out of bounds memory access may potentially occur...

CVE-2018-11836

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check can lead to out-of-bounds access in WLAN function...

CVE-2018-11294

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...

CVE-2018-11827

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write...

CVE-2018-11301

CVE-2018-11301 describes an integer overflow caused by a missing buffer-length check while processing debug log events from firmware in Android CAF builds using the Linux kernel, affecting Qualcomm WLAN Host components across Android releases such as Android for MSM, Firefox OS for MSM, and QRD A...

CVE-2018-11852

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write...

CVE-2018-11818

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, LUT configuration is passed down to driver from userspace via ioctl. Simultaneous update from userspace while kernel drivers are updating LUT registers can lead to race condition...

CVE-2018-11832

CVE-2018-11832: A heap overflow in the PMIC function due to missing input-size validation affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android). Root cause: lack of input size validation before copying to a buffer. Impact: heap overflow as described in the CVE; exploitatio...

CVE-2018-11295

The CVE-2018-11295 issue affects Qualcomm WLAN Host in Android on Pixel/Nexus devices, tied to the CAF Linux kernel WMA handler where a fixed event data length from firmware can trigger an out-of-bounds write if length fields exceed the maximum. The Android Pixel bulletin lists CVE-2018-11295 und...

CVE-2018-11294

CVE-2018-11294 affects Qualcomm CAF Android WLAN components (WLAN HOST). The issue arises in the WLAN firmware handling, where information for 4 Access Categories (AC) is provided but only the first 3 ACs are copied due to improper conditional logic. This truncation potentially affects the WLAN A...

CVE-2018-11281

CVE-2018-11281 describes a use-after-free condition in CAF-based Android variants (Android for MSM, Firefox OS for MSM, QRD Android) due to unsafe handling of IPA_IOC_MDFY_RT_RULE IOCTL header entries. If called for entries that were previously deleted, the header is used without proper validatio...

CVE-2018-11842

CVE-2018-11842 describes a memory-management fault in Qualcomm CAF WLAN host driver used in Android CAF builds during WLAN association. When memory allocation fails, the driver frees memory that was not allocated, indicating a potential use-after-free/memory-corruption condition. The vulnerabilit...

CVE-2018-5907

Possible buffer overflow in msmadspstreamcallbackput due to lack of input validation of user-provided data that leads to integer overflow in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...