CVE-2018-11823

Published: Nov 27, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver probe failure will result in double free issue in power module.

Affected (1)

Products: Google: Android

Google

1 product

Android

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Android	All versions

Related CWEs

CWE-415

Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (4)

https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=4519cc36b1a396dc55c9b43ab6e8736ae4a6f4cf

Source: product-security@qualcomm.com

PatchThird Party Advisory

https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin

Source: product-security@qualcomm.com

PatchThird Party Advisory

https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=4519cc36b1a396dc55c9b43ab6e8736ae4a6f4cf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.