Unsigned Integer Overflow in wmi_set_ie() Function Leads to Buffer Overflow in Android Releases

CVE-2018-5848 · MEDIUM Severity

AV:L/AC:L/AU:N/C:P/I:P/A:P

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Learn more about our Cis Benchmark Audit For Distribution Independent Linux.