PT-2017-3617 · Google · Android
Publicado
2017-09-26
·
Atualizado
2018-04-06
·
CVE-2017-14885
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Android versions (affected versions not specified)
Description:
The issue is caused by a buffer overflow in the wma unified link peer stats event handler function of the WLAN component in the Android operating system. This function has a variable
num rates that represents the sum of all peer stats rates. However, the current behavior only validates the num rates of the first peer stats against a maximum size limit, but not the sum of all peer rates, which may lead to a buffer overflow when copying the firmware buffer into the allocated buffer. Exploitation of this issue could allow an attacker to execute arbitrary code in the context of a privileged process using a specially crafted file.Recommendations:
For Android, consider disabling the
wma unified link peer stats event handler function as a temporary workaround until a patch is available. Restrict access to the WLAN component to minimize the risk of exploitation. Avoid using specially crafted files that could trigger the buffer overflow in the wma unified link peer stats event handler function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Android