PT-2017-11734 · Mozilla+2 · Firefox Os+2

Published 2017-11-16 · Updated 2017-11-30 · CVE-2017-11091

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description A Use-After-Free condition can potentially occur in the mdss rotator ioctl function due to a fence being installed too early. This issue is related to the /dev/mdss rotator driver and affects Android releases using the Linux kernel.

Recommendations For Android for MSM, consider restricting access to the /dev/mdss rotator driver until a fix is available. For Firefox OS for MSM, avoid using the mdss rotator ioctl function until the issue is resolved. For QRD Android, as a temporary workaround, consider disabling the mdss rotator ioctl function in the /dev/mdss rotator driver to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2017-11091

Affected Products

Android

Firefox Os

Qrd Android

References · 2

• https://source.android.com/security/bulletin/pixel/2017-11-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11091 · Security Note