PT-2018-17196 · Mozilla+2 · Firefox Os+2

Published 2018-11-27 · Updated 2018-12-21 · CVE-2018-5861

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description: The issue arises from incomplete checks on partition size, which can lead to heap overwrite vulnerabilities when loading a secure application from the boot loader. This affects Android releases using the Linux kernel from CAF.

Recommendations: For Android for MSM, update the kernel to include complete partition size checks to prevent heap overwrite vulnerabilities. For Firefox OS for MSM, ensure that secure application loading from the boot loader includes robust partition size validation. For QRD Android, modify the boot loader to enforce thorough checks on partition sizes before loading secure applications.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2018-5861

Affected Products

Android

Firefox Os

Linux Kernel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-5861 · Security Note
• https://codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin · Patch
• https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=114a392e29bc900c0fe15cc1f3e9ba369cd03244 · Patch