CVE-2017-8250: Integer Overflow
Published Sep 5, 2017
·Updated
In all Qualcomm products with Android releases from CAF using the Linux kernel, user controlled variables "nrcmds" and "nrbos" number are passed across functions without any check. An integer overflow to buffer overflow (with a smaller buffer allocated) may occur when they are too large or negative.
Affected Software
2 affected components
Google Android<=8.0
Google Android
Event History
Sep 5, 2017
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 21, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
Does an attacker need local access or credentials to exploit this issue?
The CVSS vector indicates local attack access (AV:L) and no required privileges (PR:N). User interaction is required (UI:R).
2
What could successful exploitation allow?
The CVSS assessment rates impact to confidentiality, integrity, and availability as high. Successful exploitation could therefore compromise data, alter data, or disrupt the affected device.
3
Is this assessed as a remote network vulnerability?
No. The supplied CVSS vector identifies the attack vector as local rather than network-based.