CVE-2016-3874
HighSummary
The Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices has a vulnerability related to improper validation of the arguments array. Attackers can gain privileges via a crafted application that sends a WE_UNIT_TEST_CMD command.
Risk Assessment
This vulnerability may lead to privilege escalation, posing a serious threat to the security of devices and user data. An attacker could exploit this vulnerability to take control of the device.
Recommendation
It is recommended to update the Android system to a version after 2016-09-05 to mitigate this vulnerability. Additionally, monitor applications installed on devices for potential malicious software.
Other vulnerabilities in Qualcomm Wi-Fi driver in Android
See all- CVE-2016-6680High
The Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices has a vulnerability that allows attackers to obtain sensitive information via a crafted application making an iw_set_priv ioctl call.
- CVE-2016-6676High
An off-by-one error in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application that makes a GET_CFG ioctl call.
- CVE-2016-6675High
An off-by-one error in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application that makes a linkspeed ioctl call.
- CVE-2016-3905High
The Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X devices has a vulnerability that allows attackers to gain privileges via a crafted application sending a SENDACTIONFRAME command.
- CVE-2016-3792High
The Qualcomm Wi-Fi driver in Android before 2016-07-05 on Nexus 7 (2013) devices mishandles userspace data copying, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9902Critical
Buffer overflow in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element in an 802.11 management frame.
Original NVD description (English source)
CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices does not properly validate the arguments array, which allows attackers to gain privileges via a crafted application that sends a WE_UNIT_TEST_CMD command, aka Android internal bug 29944562 and Qualcomm internal bug CR997797.