PT-2018-5737 · Mozilla+1 · Firefox Os+1

Published 2018-03-30 · Updated 2018-04-25 · CVE-2017-14883

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Android for MSM versions prior to 2017-10-18 Firefox OS for MSM versions prior to 2017-10-18 QRD Android versions prior to 2017-10-18

Description: The issue arises in the wma unified power debug stats event handler() function when the param buf->num debug register value received from the FW command buffer is close to the maximum value of uint32. This can cause an overflow, resulting in less memory being allocated for power stats results and potentially leading to a buffer overflow when copying the FW buffer to the local buffer.

Recommendations: For Android for MSM versions prior to 2017-10-18, update to a version released after 2017-10-18 to resolve the issue. For Firefox OS for MSM versions prior to 2017-10-18, update to a version released after 2017-10-18 to resolve the issue. For QRD Android versions prior to 2017-10-18, update to a version released after 2017-10-18 to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-14883

Affected Products

Android

Firefox Os

References · 3

• https://source.android.com/security/bulletin/pixel/2018-02-01 · Vendor Advisory
• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=3de34af4e2ca91e1a2260deb380b81620a631c85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-14883 · Security Note