PT-2018-10889 · Mozilla+2 · Firefox Os+2

Publicado 2018-09-19 · Atualizado 2019-04-18 · CVE-2018-11891

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue is related to a lack of check on the length of an array while accessing it, which can lead to an out of bound read in the WLAN HOST function. This affects Android releases using the Linux kernel.

Recommendations For Android for MSM, update to a version that includes the necessary checks for array length to prevent out of bound reads. For Firefox OS for MSM, apply configuration changes to restrict access to the WLAN HOST function until a fix is available. For QRD Android, consider disabling the WLAN HOST function temporarily as a mitigation measure until a patch is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

CVE-2018-11891

Produtos afetados

Android

Firefox Os

Linux Kernel

Referências · 4

• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=2fc3e8a2ae8233690872d313fbfb4c74d0c61daa · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-11891 · Nota de Segurança
• http://securityfocus.com/bid/107770 · Nota
• https://codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin · Correção