PT-2018-1068 · Mozilla+2 · Firefox Os+2

Published 2018-01-02 · Updated 2018-01-29 · CVE-2017-11069

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android for MSM versions (affected versions not specified) QRD Android versions (affected versions not specified) Firefox OS for MSM versions (affected versions not specified) All Android releases from CAF using the Linux kernel versions (affected versions not specified)

Description The issue is related to the manipulation of SafeSwitch Image data, which can result in a heap overflow. It is also described as a buffer overflow vulnerability in the Bootloader component of Android operating systems from the CAF repository. This vulnerability can be exploited by a remote attacker to cause a buffer overflow on the heap by manipulating Qualcomm SafeSwitch image data.

Recommendations For Android for MSM, consider restricting access to the SafeSwitch Image data until a patch is available. For QRD Android, avoid using the Bootloader component with untrusted input until the issue is resolved. For Firefox OS for MSM, as a temporary workaround, consider disabling the Bootloader component until a fix is provided. For all Android releases from CAF using the Linux kernel, restrict manipulation of Qualcomm SafeSwitch image data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-00410

CVE-2017-11069

Affected Products

Android

Firefox Os

Linux Kernel

References · 5

• https://bdu.fstec.ru/vul/2018-00410 · Security Note
• https://source.android.com/security/bulletin/2018-01-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11069 · Security Note
• http://securitytracker.com/id/1040106 · Note
• http://securityfocus.com/bid/102413 · Note