PT-2018-10468 · Mozilla+2 · Firefox Os+2

Publicado 2018-09-18 · Atualizado 2018-11-09 · CVE-2018-11302

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue is related to a lack of input validation from userspace before copying data into a buffer, potentially leading to an array overflow in the WLAN component of the Linux kernel used in Android releases.

Recommendations For Android for MSM, update to a version that includes input validation checks for userspace data to prevent array overflows in WLAN. For Firefox OS for MSM, consider implementing input validation for data received from userspace to mitigate the risk of array overflows in WLAN until a fixed version is available. For QRD Android, restrict access to the WLAN component to minimize the risk of exploitation due to array overflows until a patch or update with proper input validation is released.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-11302

Produtos afetados

Android

Firefox Os

Linux Kernel

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11302 · Nota de Segurança
• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=4178ed2227bbc48d4313bc4e7d604d2813c0d9f4 · Correção
• https://codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin · Correção