PT-2017-3614 · Google · Android

Publicado 2017-09-27 · Atualizado 2018-04-06 · CVE-2017-18063

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android (affected versions not specified)

Description: The issue is related to the wma nlo match evt handler function in the WLAN component of the Android operating system, which is part of the CAF repository. It involves an out-of-bounds memory access operation. This could allow an attacker to execute arbitrary code in the context of a privileged process using a specially crafted file. The problem arises from improper input validation for the nlo event in the wma nlo match evt handler() function, which receives input from firmware.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-20

CWE-119

Identificadores relacionados

BDU:2018-00597

CVE-2017-18063

Produtos afetados

Android

Referências · 5

• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=b9c0beac8f021f774f39df54e1f96fd87c2660f0 · Correção
• https://source.android.com/security/bulletin/2018-03-01 · Aviso do Fabricante
• http://securityfocus.com/bid/103254 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-18063 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00597 · Nota de Segurança