CVE-2017-15854

The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for…

published June 12, 2018

CVSS
—
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Published
2018-06-12T20:00Z
EPSS history
Timeline
  • 12 JUN 20:00Z
    The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for…
    cvelistv5