CVE-2017-15845 Integer overflow in Android for MSM, Firefox OS for MSM, QRD Android
A negative firmware size input in the WLAN driver can cause memory leaks or buffer overflows, potentially allowing attackers to read memory or execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-15845?
CVE-2017-15845 is a high-severity vulnerability in Google Android, published on 10 Jan 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size (negative value) from user space can potentially lead to the memory leak or buffer overflow during the WLAN cal data store operation.
Which versions are affected by CVE-2017-15845?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2017-15845?
No fix has been published for CVE-2017-15845 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-15845 being exploited?
There is no known exploitation of CVE-2017-15845 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as GHSA-7gg9-xr98-9cmr.