Android for MSM, Firefox OS for MSM, QRD Android vulnerabilities

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to direct access to a userspace buffer in kernel space while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND.

In Android for MSM, Firefox OS for MSM, and QRD Android, after a subsystem reset, iwpriv does not provide correct information. This affects all Android releases from CAF using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs when updating custom EDID if edid_size, controlled by userspace, is too large.

In Android for MSM, Firefox OS for MSM, and QRD Android, the IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts, which can lead to buffer overflow of the msg cache.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overwrite is possible in fw_name_store if the image name is 64 characters long.

In Android for MSM, Firefox OS for MSM, and QRD Android, improperly specified offset/size values for a submission command may lead to a math operation overflow, resulting in access to arbitrary memory.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_MAC_ADDR attribute contains fewer than 6 bytes.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists related to the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command, which can lead to a Use After Free condition.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with not closing the file descriptor (fd) during metadata retrieval, even though the buffer has been freed. This leads to a failure during the exit sequence.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with improper memory management. When memory allocation fails while creating a calibration block, stale pointers are left uncleared.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists in the boot loader while parsing the splash image.

In Android for MSM, Firefox OS for MSM, and QRD Android, while processing OEM unlock/unlock-go fastboot commands, a data leak may occur due to writing uninitialized stack structure to non-volatile memory.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to incorrect buffer size checking in the qbt1000 ioctl handler, potentially leading to a buffer overflow.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a lack of race condition protection while updating the msg mask table, which can lead to buffer over-read. Additionally, access to freed memory can occur while updating msg_mask information.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a buffer over-read vulnerability in the display module. This issue arises from a lack of upper-bound validation when reading 'num_of_cea_blocks' from an untrusted source (EDID), potentially exposing kernel memory.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overread is observed in __wlan_hdd_cfg80211_set_pmksa when a user space application sends PMKID of size less than WLAN_PMKID_LEN bytes.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overread is observed in nl80211_set_station. This issue occurs when a user space application sends the NL80211_ATTR_LOCAL_MESH_POWER_MODE attribute with data smaller than 4 bytes.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer over-read can occur while processing a specially crafted cfg80211 vendor command.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to processing the boot image header. Range checks can be bypassed by supplying different versions of the header at the time of check and use.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a potential buffer overflow or information leak in the functions 'sme_set_ft_ies' and 'csr_roam_issue_ft_preauth_req' due to incorrect initialization of WEXT callbacks and lack of buffer size checks.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability related to double free can occur when kmalloc fails to allocate memory for pointers resp/req in the service-locator driver function service_locator_send_msg().

In Android for MSM, Firefox OS for MSM, and QRD Android, while flashing UBI image, the size is not validated, leading to an uninitialized data access vulnerability.

In Android for MSM, Firefox OS for MSM, and QRD Android, while flashing FRP partition using reference FRP unlock, the authentication method can be compromised for static keys.

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition in the function audio_effects_shared_ioctl() can lead to memory corruption.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of out-of-bound buffer accesses due to no synchronization in accessing global variables by multiple threads.

In Android for MSM, Firefox OS for MSM, and QRD Android, flashing a specially crafted UBI image can lead to memory corruption or access to uninitialized memory.

In Android for MSM, Firefox OS for MSM, and QRD Android, the value of SIR_MAC_AUTH_CHALLENGE_LENGTH is set to 128, which may lead to a buffer overflow. The frame parser allows challenge text of length up to 253 bytes, while the driver cannot handle challenge text larger than 128 bytes.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs while parsing a Measurement Request IE in a Roam Neighbor Action Report. This affects all Android releases from CAF using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, with all Android releases using the Linux kernel, the UnpackCore function increases the countOffset variable in each loop iteration without checking the boundary 'pIe->arraybound'.

In Android for MSM, Firefox OS for MSM, and QRD Android, a stack-based buffer overflow vulnerability exists when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_ENCRYPTION_TEST cfg80211 vendor command.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to buffer overread while parsing Netlink attributes. This affects all Android releases from CAF using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists related to buffer over-read while processing a vendor command.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability that allows out of bound memory access in the limCheckRxRSNIeMatch function when an incorrect RSNIE is received from the client in the association request.

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition can allow access to already freed memory while reading command registration table entries in diag_dbgfs_read_table.

In Android for MSM, Firefox OS for MSM, and QRD Android, issues arise from concurrent access to the debugfs file, leading to double-free and Use-After-Free situations.

In Android for MSM, Firefox OS for MSM, and QRD Android, while flashing a meta image, an integer overflow can occur if user-defined image offset and size values are too large.

In Android for MSM and Firefox OS for MSM, a buffer overread issue is observed during the processing of cfg80211 vendor commands related to the passpoint list. This issue affects all Android releases using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with attribute validation in the __wlan_hdd_cfg80211_do_acs function, which can potentially lead to a buffer overread.

In Android for MSM and Firefox OS for MSM, a buffer overread issue is observed during the processing of cfg80211 vendor commands related to the passpoint list. This issue affects all Android releases using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to setting the HMAC key by different threads during SHA operations, which may lead to a buffer overflow.

In Android for MSM, Firefox OS for MSM, and QRD Android, in compatibility mode, flash_data from 64-bit userspace may lead to disclosure of kernel memory or a fault due to using a userspace-provided address.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with accessing a userspace buffer in kernel space during sha and cipher operations, potentially leading to a page fault.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION cfg80211 vendor command, which can lead to a buffer over-read.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists related to processing a specially crafted cfg80211 vendor command, which can lead to a buffer over-read.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists in the ConvertQosMapsetFrame() function when a QoS map of length less than 16 is received in an association response or in a QoS map configure action frame.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_NDP cfg80211 vendor command, which can lead to a buffer over-read.