CVE-2017-9710
HighSummary
In Android for MSM, Firefox OS for MSM, and QRD Android, the IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts, which can lead to buffer overflow of the msg cache.
Risk Assessment
Buffer overflow may allow an attacker to execute malicious code, posing a serious threat to the security of devices and user data.
Recommendation
It is recommended to update systems to the latest versions that mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in Android for MSM, Firefox OS for MSM, QRD Android
See all- CVE-2017-14897High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to direct access to a userspace buffer in kernel space while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND.
- CVE-2017-14895High
In Android for MSM, Firefox OS for MSM, and QRD Android, after a subsystem reset, iwpriv does not provide correct information. This affects all Android releases from CAF using the Linux kernel.
- CVE-2017-11007High
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.
- CVE-2017-9722High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs when updating custom EDID if edid_size, controlled by userspace, is too large.
- CVE-2017-9700High
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overwrite is possible in fw_name_store if the image name is 64 characters long.
- CVE-2017-9698High
In Android for MSM, Firefox OS for MSM, and QRD Android, improperly specified offset/size values for a submission command may lead to a math operation overflow, resulting in access to arbitrary memory.
- CVE-2017-14901High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.
- CVE-2017-14900High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_MAC_ADDR attribute contains fewer than 6 bytes.
- CVE-2017-14899High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte.
- CVE-2017-14898High
In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.
Original NVD description (English source)
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts which can result in buffer overflow of msg cache.