CVE-2017-11089 Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android
A buffer overread in the Linux kernel's nl80211 module allows local attackers to cause denial of service or leak information via crafted netlink messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11089?
CVE-2017-11089 is a high-severity memory corruption vulnerability in Google Android, published on 16 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes
Weakness: CWE-125
Which versions are affected by CVE-2017-11089?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2017-11089?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-11089 being exploited?
There is no known exploitation of CVE-2017-11089 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as DEBIAN-CVE-2017-11089, GHSA-2rw2-4f93-gf5g, UBUNTU-CVE-2017-11089.