CVE-2018-11301 - Integer Underflow (Wrap or Wraparound)

Severity

46%

Complexity

39%

Confidentiality

106%

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on buffer length while processing debug log event from firmware can lead to an integer overflow.

CVSS 3.0 Base Score 7.8. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 4.6. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P).

Demo Examples

Integer Underflow (Wrap or Wraparound)

CWE-191

The following example subtracts from a 32 bit signed integer.


               }return 0;

The example has an integer underflow. The value of i is already at the lowest negative value possible, so after subtracting 1, the new value of i is 2147483647.

Overview

First reported 6 years ago

2018-09-18 18:29:00

Last updated 6 years ago

2018-11-09 17:33:00

Affected Software

Google Android Operating System

References

https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components

Patch, Vendor Advisory

https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=31ad3a5a7458e60f5e0ba4f492cebe1f1bda0964

Patch, Third Party Advisory

https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin