Stack overflow in wifi driver function __wlan_hdd_change_station (CVE-2016-10283)

Release Date: 
May 1, 2017
Advisory ID: 
QCIR-2017-00033-1
Summary: 

The following security vulnerabilities have been identified:

 
CVE-2016-10283

User can give number of operation classes more than 32 through HDD change station command. This will result in stack overflow during memcopy as the max number of supported channels is 32.

Access Vector: Local
Security Risk: Medium
Vulnerability: CWE-120 Buffer Copy Without Checking Size of Input (‘Classic Buffer Overflow’)

Affected Versions:
All Android releases from CAF using the Linux kernel.

Acknowledgement: 

This issue was reported to Google by an external security researcher. Qualcomm Innovation Center, Inc. (QuIC) thanks Google for bringing this issue to QuIC's attention.

Revisions: 

Initial revision

Contact: 
security-advisory@quicinc.com