CVE-2017-11053
HighSummary
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists in the ConvertQosMapsetFrame() function when a QoS map of length less than 16 is received in an association response or in a QoS map configure action frame.
Risk Assessment
This vulnerability could lead to unauthorized memory access, posing a risk of executing malicious code and potentially taking control of the device.
Recommendation
It is recommended to update the system to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Android for MSM, Firefox OS for MSM, QRD Android
See all- CVE-2017-14897High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to direct access to a userspace buffer in kernel space while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND.
- CVE-2017-14895High
In Android for MSM, Firefox OS for MSM, and QRD Android, after a subsystem reset, iwpriv does not provide correct information. This affects all Android releases from CAF using the Linux kernel.
- CVE-2017-11007High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.
- CVE-2017-9722High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs when updating custom EDID if edid_size, controlled by userspace, is too large.
- CVE-2017-9710High
In Android for MSM, Firefox OS for MSM, and QRD Android, the IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts, which can lead to buffer overflow of the msg cache.
- CVE-2017-9700High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overwrite is possible in fw_name_store if the image name is 64 characters long.
- CVE-2017-9698High
In Android for MSM, Firefox OS for MSM, and QRD Android, improperly specified offset/size values for a submission command may lead to a math operation overflow, resulting in access to arbitrary memory.
- CVE-2017-14901High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.
- CVE-2017-14900High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_MAC_ADDR attribute contains fewer than 6 bytes.
- CVE-2017-14899High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte.
Original NVD description (English source)
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of length less than 16 is received in association response or in qos map configure action frame, a buffer overflow can potentially occur in ConvertQosMapsetFrame().