CVE-2018-5848

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Link	Resource
https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2	Patch Third Party Advisory
https://source.android.com/security/bulletin/pixel/2018-05-01	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3096	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3083	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2948	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:o:google:android:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

---

Published : 2018-06-12 08:29

Updated : 2019-05-02 03:54

---

NVD link : CVE-2018-5848

Mitre link : CVE-2018-5848

No products.

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-190