Skip to main content

Out-of-bounds write in wifi driver function hdd_extscan_epno_fill_network_list (CVE-2016-8420)

Release Date:

February 14, 2017

Affected Projects:

Android for MSMFirefox OS for MSMQRD Android

Advisory ID:


CVE ID(s):



The following security vulnerabilities have been identified: CVE-2016-8420 Currently when processing an EPNO vendor command the "num networks" attribute is limit checked and if it exceeds a MAX value then it is reset to that MAX value. This value is then used to calculate the size of the buffer allocated to hold the internal representation of the request. However later when the network attributes are parsed there is no check to make sure the number of networks processed does not exceed the (possibly modified) "num networks" used to allocate memory, and as a result a buffer overflow can occur.

Access Vector: Local
Security Risk: Medium
Access Vector: Local

Affected Versions:

All Android releases from CAF using the Linux kernel.


We advise customers to apply the following patches:

Individual Patches


This issue was reported to Google by an external security researcher. Qualcomm Innovation Center, Inc. (QuIC) thanks Google for bringing this issue to QuIC's attention.