CVE-2015-9136: Buffer Overflow
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, in pre-auth request, Host driver uses FT IEs sent by the supplicant. A buffer overflow may occur if FT IEs sent by the supplicant are larger than the expected value.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-9136?
CVE-2015-9136 is a vulnerability in Android devices before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, where the Host driver uses an incorrect length when creating an ioctl argument copy in uapi/usb/cdc_ncm.c, leading to an arbitrary kernel memory write.
What is the severity of CVE-2015-9136?
The severity of CVE-2015-9136 is critical, with a severity value of 9.8.
Which software is affected by CVE-2015-9136?
Android devices before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20 are affected by CVE-2015-9136.
How can I fix the CVE-2015-9136 vulnerability?
To fix the CVE-2015-9136 vulnerability, you should update your Android device to at least the 2018-04-05 security patch level or install a later security patch.
Where can I find more information about CVE-2015-9136?
You can find more information about CVE-2015-9136 on the SecurityFocus and Android Security Bulletins websites.