CVE-2017-10999: Buffer Overflow
Published Sep 5, 2017
·Updated
In all Qualcomm products with Android releases from CAF using the Linux kernel, concurrent calls into ioctl RMNETIOCTLADDMUXCHANNEL in ipa wan driver may lead to memory corruption due to missing locks.
Affected Software
2 affected components
Google Android<=8.0
Google Android
Event History
Sep 5, 2017
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 21, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What access and interaction are required for exploitation?
The CVSS vector indicates local attack access, no privileges required, and user interaction required. It is not rated as remotely exploitable over the network.
2
Which devices should be assessed first?
Prioritize Qualcomm-based Android devices using Android releases from CAF with a Linux kernel, particularly where the IPA WAN driver is present. The listed software product is Google Android.
3
What is the likely security impact if exploitation succeeds?
The vulnerability is rated high severity with a CVSS 3.0 score of 7.8. Its vector assigns high impacts to confidentiality, integrity, and availability.