security-advisory@quicinc.com
Multiple Issues in WLAN Driver Allow Local Privilege Escalation (CVE-2015-0569, CVE-2015-0570, CVE-2015-0571)
Release Date:
December 18, 2015
Affected Projects:
Android for MSMFirefox OS for MSMQRD Android
Advisory ID:
QCIR-2015-00004-1
CVE ID(s):
CVE-2015-0569CVE-2015-0570CVE-2015-0571
Summary:
CVE-2015-0569: A heap overflow occurs when setting packet filters using private wireless extensions IOCTLs because user-supplied lengths are used without verifying that the length does not exceed the size of the destination buffer. Vulnerability: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) --- CVE-2015-0570: A stack overflow occurs when the SET_WPS_IE IOCTL is invoked if the user-supplied length of a WPS IE element exceeds the default data length. Vulnerability: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) --- CVE-2015-0571: WLAN private set IOCTLs can be invoked with insufficient privileges. Vulnerability: CWE-284 (Improper Access Control)
Access Vector: Local
Security Risk: High
Access Vector: Local
Affected Versions:
All Android releases from CAF using the Linux kernel.
Patch:
We advise customers to apply the following patches:
- CVE-2015-0569:
https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a079d716b5481223f0166c644e9ec7c75a31b02c - CVE-2015-0570:
https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=8bd73c3452ab22ba9bdbaac5ab12de2ed25fcb9d - CVE-2015-0571:
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6feb2faf80a05940618aa2eef2b62e4e2e54f148
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fe4208157c899a5de4d6769d13f6620fc32ebfa9
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0e53a89bfe0dbb50e0dde9a6960d274386247cd9
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=88ce639e7a0bba852f193b6f53b7ca1926a09b02
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0858d21caf17d56f8d2353590c1ec245073222e0
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2905578424256be07e6b9d8c63bb83d40cc52a71
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=be62ecde85228b91c66fb047e27d25132f56bd0d
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=aaeeed43f9597631982835481c7cf2621f6455f0
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6642bccf3ed8cba176dee7d4bbc21fc4580efb7b
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6665a9697b404acf4d2e7d52d9c2b19512c9b239
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=9eeafd788f53cc37c169b299f91ca9c558b228f9
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=55bdc6d1c88a100dc4a71bf855b69db522c9b5b5
- https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fb9fb202c71547dba648c9b08d97645c6f42ca6e
Acknowledgement:
Qualcomm Innovation Center, Inc. (QuIC) thanks Renjia Lu for reporting the related issues and working with QuIC to help improve Android device security.
Revisions:
Initial revision