CVE-2017-11038
HighSummary
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to processing the boot image header. Range checks can be bypassed by supplying different versions of the header at the time of check and use.
Risk Assessment
This vulnerability may lead to unauthorized access or data manipulation within the system, posing a threat to the integrity and confidentiality of information.
Recommendation
It is recommended to update the system to the latest version to patch this vulnerability and to monitor for any unauthorized changes to boot image headers.
Other vulnerabilities in Android for MSM, Firefox OS for MSM, QRD Android
See all- CVE-2017-14897High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to direct access to a userspace buffer in kernel space while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND.
- CVE-2017-14895High
In Android for MSM, Firefox OS for MSM, and QRD Android, after a subsystem reset, iwpriv does not provide correct information. This affects all Android releases from CAF using the Linux kernel.
- CVE-2017-11007High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.
- CVE-2017-9722High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs when updating custom EDID if edid_size, controlled by userspace, is too large.
- CVE-2017-9710High
In Android for MSM, Firefox OS for MSM, and QRD Android, the IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts, which can lead to buffer overflow of the msg cache.
- CVE-2017-9700High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overwrite is possible in fw_name_store if the image name is 64 characters long.
- CVE-2017-9698High
In Android for MSM, Firefox OS for MSM, and QRD Android, improperly specified offset/size values for a submission command may lead to a math operation overflow, resulting in access to arbitrary memory.
- CVE-2017-14901High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.
- CVE-2017-14900High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_MAC_ADDR attribute contains fewer than 6 bytes.
- CVE-2017-14899High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte.
Original NVD description (English source)
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the boot image header, range checks can be bypassed by supplying different versions of the header at the time of check and use.