PT-2017-3614 · Google · Android

Published 2017-09-27 · Updated 2018-04-06 · CVE-2017-18063

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android (affected versions not specified)

Description: The issue is related to the wma nlo match evt handler function in the WLAN component of the Android operating system, which is part of the CAF repository. It involves an out-of-bounds memory access operation. This could allow an attacker to execute arbitrary code in the context of a privileged process using a specially crafted file. The problem arises from improper input validation for the nlo event in the wma nlo match evt handler() function, which receives input from firmware.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

BDU:2018-00597

CVE-2017-18063

Affected Products

Android

References · 5

• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=b9c0beac8f021f774f39df54e1f96fd87c2660f0 · Patch
• https://source.android.com/security/bulletin/2018-03-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18063 · Security Note
• https://bdu.fstec.ru/vul/2018-00597 · Security Note
• http://securityfocus.com/bid/103254 · Note