PT-2017-11734 · Mozilla+2 · Firefox Os+2

Publicado 2017-11-16 · Atualizado 2017-11-30 · CVE-2017-11091

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description A Use-After-Free condition can potentially occur in the mdss rotator ioctl function due to a fence being installed too early. This issue is related to the /dev/mdss rotator driver and affects Android releases using the Linux kernel.

Recommendations For Android for MSM, consider restricting access to the /dev/mdss rotator driver until a fix is available. For Firefox OS for MSM, avoid using the mdss rotator ioctl function until the issue is resolved. For QRD Android, as a temporary workaround, consider disabling the mdss rotator ioctl function in the /dev/mdss rotator driver to minimize the risk of exploitation.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2017-11091

Produtos afetados

Android

Firefox Os

Qrd Android

Referências · 2

• https://source.android.com/security/bulletin/pixel/2017-11-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11091 · Nota de Segurança