CVE-2018-21054

Published: Apr 8, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered on Samsung mobile devices with M(6.0), N(7.x) and O(8.x) except exynos9610/9820 in all Platforms, M(6.0) except MSM8909 SC77xx/9830 exynos3470/5420, N(7.0) except MSM8939, N(7.1) except MSM8996 SDM6xx/M6737T software. There is an integer underflow with a resultant buffer overflow in eCryptFS. The Samsung ID is SVE-2017-11857 (September 2018).

Affected (8)

Products: Google: Android

Google

1 product

Android

Configuration A

5 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Google Android	Version 7.1.0
Google Android	Version 7.1.1
Google Android	Version 7.1.2
Google Android	Version 8.0
Google Android	Version 8.1

Running on/with	Platform Versions
Samsung Exynos 9610	All versions
Samsung Exynos 9820	All versions

Configuration B

1 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Google Android	Version 6.0

Running on/with	Platform Versions
Qualcomm Msm8909	All versions
Qualcomm Msm9830	All versions
Samsung Exynos 3470	All versions
Samsung Exynos 5420	All versions
Unisoc Sc7715	All versions
Unisoc Sc7730	All versions
Unisoc Sc7731	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Google Android	Version 7.0

Running on/with	Platform Versions
Qualcomm Msm8939	All versions

Configuration D

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Google Android	Version 7.1

Running on/with	Platform Versions
Mediatek M6737t	All versions
Qualcomm Msm8996	All versions
Qualcomm Sdm6xx	All versions

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (2)

https://security.samsungmobile.com/securityUpdate.smsb

Source: cve@mitre.org

Vendor Advisory

https://security.samsungmobile.com/securityUpdate.smsb

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.