PT-2018-10468 · Mozilla+2 · Firefox Os+2

Published 2018-09-18 · Updated 2018-11-09 · CVE-2018-11302

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue is related to a lack of input validation from userspace before copying data into a buffer, potentially leading to an array overflow in the WLAN component of the Linux kernel used in Android releases.

Recommendations For Android for MSM, update to a version that includes input validation checks for userspace data to prevent array overflows in WLAN. For Firefox OS for MSM, consider implementing input validation for data received from userspace to mitigate the risk of array overflows in WLAN until a fixed version is available. For QRD Android, restrict access to the WLAN component to minimize the risk of exploitation due to array overflows until a patch or update with proper input validation is released.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-11302

Affected Products

Android

Firefox Os

Linux Kernel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11302 · Security Note
• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=4178ed2227bbc48d4313bc4e7d604d2813c0d9f4 · Patch
• https://codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin · Patch