PT-2018-10884 · Mozilla+2 · Firefox Os+2

Published 2018-09-19 · Updated 2018-11-09 · CVE-2018-11883

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue occurs when the mode parameter in the wlan function is given an out of bound value, causing an out of bound access while accessing the PCL table in the policy mgr unit test. This is a problem in all Android releases from CAF using the linux kernel.

Recommendations For Android for MSM, update the policy manager to validate the mode parameter in the wlan function to prevent out of bound access. For Firefox OS for MSM, restrict access to the wlan function until a patch is available to fix the out of bound access issue. For QRD Android, consider disabling the policy mgr unit test until a fix is implemented to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2018-11883

Affected Products

Android

Firefox Os

Qrd Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11883 · Security Note
• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=5f21c4fa98f05423552da8716c80abfb7ca43091 · Patch
• https://codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin · Patch