PT-2018-10444 · Mozilla+2 · Firefox Os+3

Published 2018-09-18 · Updated 2019-03-05 · CVE-2018-11275

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description A potential information leak issue occurs in Android releases when using FastbootLib to flash an image, specifically if the image size is not divisible by the block size.

Recommendations For Android for MSM, update the flashing process to ensure image sizes are properly aligned with block sizes to prevent information leaks. For Firefox OS for MSM, modify the FastbootLib usage to handle image sizes that are not divisible by the block size, mitigating the information leak risk. For QRD Android, adjust the image flashing protocol to account for block size divisibility, thereby preventing potential information leaks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-11275

Affected Products

Android

Fastbootlib

Firefox Os

Qrd Android

References · 4

• https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=bf0261ab128f28763258c620bc95ca379a286b59 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11275 · Security Note
• https://codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin · Patch
• http://securityfocus.com/bid/106949 · Note