UBUNTU-CVE-2017-11089

Description

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes

CVSS Metrics

• v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Systems

• ubuntu•linux

  < 3.13.0-144.193 | < 4.4.0-93.116

• ubuntu•linux-aws

  < 4.4.0-1032.41

• ubuntu•linux-azure-fde

  all

• ubuntu•linux-gcp

  < 4.13.0-1002.5

• ubuntu•linux-gke

  < 4.4.0-1028.28 | all

• ubuntu•linux-hwe

  < 4.13.0-32.35~16.04.1 | all

• ubuntu•linux-hwe-edge

  all

• ubuntu•linux-intel-iot-realtime

  all

• ubuntu•linux-lts-xenial

  < 4.4.0-93.116~14.04.1

• ubuntu•linux-raspi-realtime

  all

• ubuntu•linux-raspi2

  < 4.4.0-1071.79 | all

• ubuntu•linux-realtime

  all

• ubuntu•linux-riscv

  all | all

• ubuntu•linux-snapdragon

  < 4.4.0-1073.78

References (5)

• https://ubuntu.com/security/CVE-2017-11089
• https://source.android.com/security/bulletin/pixel/2017-11-01
• https://ubuntu.com/security/notices/USN-3620-1
• https://ubuntu.com/security/notices/USN-3620-2
• https://www.cve.org/CVERecord?id=CVE-2017-11089