CVE-2017-11051
HighSummary
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability that allows information disclosure in the function __wlan_hdd_cfg80211_testmode due to the uninitialized buffer hb_params.
Risk Assessment
Information disclosure may lead to data leakage, posing a threat to user privacy and system security.
Recommendation
It is recommended to update the system to the latest version to ensure proper buffer initialization and minimize the risk of information disclosure.
Other vulnerabilities in Android for MSM, Firefox OS for MSM, QRD Android
See all- CVE-2017-14897High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to direct access to a userspace buffer in kernel space while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND.
- CVE-2017-14895High
In Android for MSM, Firefox OS for MSM, and QRD Android, after a subsystem reset, iwpriv does not provide correct information. This affects all Android releases from CAF using the Linux kernel.
- CVE-2017-11007High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.
- CVE-2017-9722High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs when updating custom EDID if edid_size, controlled by userspace, is too large.
- CVE-2017-9710High
In Android for MSM, Firefox OS for MSM, and QRD Android, the IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts, which can lead to buffer overflow of the msg cache.
- CVE-2017-9700High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overwrite is possible in fw_name_store if the image name is 64 characters long.
- CVE-2017-9698High
In Android for MSM, Firefox OS for MSM, and QRD Android, improperly specified offset/size values for a submission command may lead to a math operation overflow, resulting in access to arbitrary memory.
- CVE-2017-14901High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.
- CVE-2017-14900High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_MAC_ADDR attribute contains fewer than 6 bytes.
- CVE-2017-14899High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte.
Original NVD description (English source)
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is possible in function __wlan_hdd_cfg80211_testmode since buffer hb_params is not initialized to zero.