PT-2017-3416 · Mozilla+3 · Firefox Os+3

Published 2017-09-05 · Updated 2017-12-20 · CVE-2017-14917

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android for MSM versions (affected versions not specified) QRD Android versions (affected versions not specified) Firefox OS for MSM versions (affected versions not specified) All Android releases from CAF using the Linux kernel versions (affected versions not specified)

Description The issue is related to the message passing interface, where buffer sizes are not properly validated. This could allow a remote attacker to execute arbitrary code.

Recommendations For Android for MSM, consider implementing input validation for buffer sizes in the message passing interface until a patch is available. For QRD Android, restrict access to the message passing interface to minimize the risk of exploitation. For Firefox OS for MSM, avoid using the vulnerable message passing interface until the issue is resolved. For all Android releases from CAF using the Linux kernel, as a temporary workaround, consider disabling the vulnerable parts of the message passing interface until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-680

Related Identifiers

BDU:2018-00204

CVE-2017-14917

Affected Products

Android

Firefox Os

Linux Kernel

Qrd Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-14917 · Security Note
• https://source.android.com/security/bulletin/2017-12-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00204 · Security Note
• http://securityfocus.com/bid/102072 · Note
• https://qualcomm.com/company/product-security/bulletins · Note