CVE-2018-5848: In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly

Description

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 33% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AN

Android · Google

All versions, or not specified · source: NVD

DL

Debian Linux · Debian

8.0 · source: NVD

EL

Enterprise Linux Desktop · Redhat

7.0 · source: NVD

EL

Enterprise Linux Server · Redhat

7.0 · source: NVD

EL

Enterprise Linux Workstation · Redhat

7.0 · source: NVD

VH

Virtualization Host · Redhat

4.0 · source: NVD