CVE-2018-11902

CVE-2018-11902 affects Qualcomm WLAN host components in Android CAF builds; root cause is lack of length validation for a value received from firmware, leading to out-of-bounds access in WLAN HOST. The CVE is listed with High severity (per Qualcomm’s 2019-10-05 bulletin grouping for WLAN host). N...

CVE-2018-11886

CVE-2018-11886 affects Qualcomm WLAN host in Android CAF/linux-kernel WLAN stack. Root cause: missing validation when calculating MPDU data length leads to an integer overflow, then a buffer overflow in the WLAN function. Impact per sources is consistent with local, low-privilege exploitation and...

CVE-2018-11889

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when requesting rssi timeout, access invalid memory may occur since local variable 'context' stack data of wlan function is free...

CVE-2018-11903

CVE-2018-11903 affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The vulnerability arises from a lack of length validation for a value received from a caller function that is used as an index into WMA interfaces, enabling an out-of-bounds wri...

PT-2018-10896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a lack of length validation check for a value received from firmware, which can lead to out-of-bounds OOB access in the WLAN HOST. This affects Android releases,...

CVE-2018-11903: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from caller function used as an array index for WMA interfaces can lead to OOB write in WLAN HOST...

CVE-2018-11883: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, in policy mgr unit test if mode parameter in wlan function is given an out of bound value it can cause an out of bound access while accessing the PCL table...

CVE-2018-11886: Integer Overflow or Wraparound

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check while calculating the MPDU data length will cause an integer overflow and then to buffer overflow in WLAN function...

CVE-2018-11902: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to OOB access in WLAN HOST...

PT-2018-10897

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a lack of length validation check for a value received from a caller function used as an array index for WMA interfaces in the WLAN HOST, which can lead to an...

PT-2018-10892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an improper length check validation in the WLAN function, which can cause the driver to write default RSN capabilities to memory not allocated to the frame. This...

PT-2018-10887

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue occurs when requesting RSSI timeout in the Linux kernel used by Android releases, potentially leading to access of invalid memory. This happens because the local variable...

PT-2018-10889

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a lack of check on the length of an array while accessing it,...

PT-2018-10879

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns a possibility of invalid memory access while processing a driver command in the WLAN function. This affects Android releases, including Android for MSM, Firefox OS for...

PT-2018-10884

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue occurs when the mode parameter in the wlan function is given an out of bound...

PT-2018-10886

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is caused by a lack of check while calculating the MPDU data length, resulting in an integer overflow and subsequently a buffer overflow in the WLAN function. This affects all...

CVE-2018-11895: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check Validation in WLAN function can lead to driver writes the default rsn capabilities to the memory not allocated to the frame...

CVE-2018-11878: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, possibility of invalid memory access while processing driver command in WLAN function...

CVE-2018-11891: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on the length of array while accessing can lead to an out of bound read in WLAN HOST function...

CVE-2018-11840

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice...