PT-2018-10884 · Mozilla+2 · Firefox Os+2

Publicado 2018-09-19 · Atualizado 2018-11-09 · CVE-2018-11883

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue occurs when the mode parameter in the wlan function is given an out of bound value, causing an out of bound access while accessing the PCL table in the policy mgr unit test. This is a problem in all Android releases from CAF using the linux kernel.

Recommendations For Android for MSM, update the policy manager to validate the mode parameter in the wlan function to prevent out of bound access. For Firefox OS for MSM, restrict access to the wlan function until a patch is available to fix the out of bound access issue. For QRD Android, consider disabling the policy mgr unit test until a fix is implemented to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

CVE-2018-11883

Produtos afetados

Android

Firefox Os

Qrd Android

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11883 · Nota de Segurança
• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=5f21c4fa98f05423552da8716c80abfb7ca43091 · Correção
• https://codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin · Correção