The following security vulnerabilities have been identified:
Currently when processing a passpoint vendor command the "num networks" attribute is limit checked and if it exceeds a MAX value then the command is rejected. Otherwise this value is used to calculate the size of the buffer allocated to hold the internal representation of the request. However later when the network attributes are parsed there is no check to make sure the number of networks processed does not exceed the "num networks" used to allocate memory, and as a result a buffer overflow can occur.
Access Vector: Local
Security Risk: Medium
Vulnerability: CWE-129 Improper Validation of Array Index
All Android releases from CAF using the Linux kernel.
We advise customers to apply the following patches:
This issue was reported to Google by an external security researcher. Qualcomm Innovation Center, Inc. (QuIC) thanks Google for bringing this issue to QuIC's attention.