CVE-2018-5848: Buffer Overflow
In the function wmisetie() in the Linux kernel the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the ‘ielen’ argument can cause a buffer overflow and thus a memory corruption leading to a system crash or other or unspecified impact.
References:
https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2#CVE-2018-5848
https://marc.info/?l=linux-wireless&m=151066597529493&w=2
An upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5a8ffcae4103a9d823ea3aa3a761f65779fbe2a
Other sources
In the function wmisetie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ielen' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the Linux kernel to include the upstream fix for the wmi_set_ie() unsigned integer overflow in length validation (issue caused by a large 'ie_len' value in wmi_set_ie() leading to buffer overflow/memory corruption).
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5848?
CVE-2018-5848 has a high severity rating due to the potential for buffer overflow leading to code execution.
How do I fix CVE-2018-5848?
To fix CVE-2018-5848, apply the latest security patches provided by your operating system vendor.
Which systems are affected by CVE-2018-5848?
CVE-2018-5848 affects all Android releases from CAF and specific versions of Red Hat Enterprise Linux and Debian GNU/Linux.
What is the nature of the vulnerability in CVE-2018-5848?
CVE-2018-5848 is a buffer overflow vulnerability caused by improper handling of unsigned integer overflow in the wmi_set_ie() function.
Can CVE-2018-5848 be exploited remotely?
Yes, CVE-2018-5848 can potentially be exploited remotely, allowing attackers to execute arbitrary code on affected devices.