Vulnerability Description
In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_list" is very large which can then lead to a heap overwrite of the heap object end_rsp in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Android | - |
Related Weaknesses (CWE)
References
- https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-secPatchThird Party Advisory
- https://source.android.com/security/bulletin/pixel/2018-05-01Third Party Advisory
- https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-secPatchThird Party Advisory
FAQ
What is CVE-2017-18070?
CVE-2017-18070 is a vulnerability with a CVSS score of 7.8 (HIGH). In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_list" is very large which can then lead t...
How severe is CVE-2017-18070?
CVE-2017-18070 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-18070?
Check the references section above for vendor advisories and patch information. Affected products include: Google Android.