CVE-2016-5342

Vulnerability

A heap-based buffer overflow exists in the wcnss_wlan_write function in drivers/net/wireless/wcnss/wcnss_wlan.c of the Linux kernel 3.x, as used in Qualcomm MSM devices and other products. The vulnerability allows an attacker to cause a denial of service or possibly have unspecified other impact by writing an unexpected amount of data to the /dev/wcnss_wlan device file [1].

Exploitation

An attacker requires write access to the /dev/wcnss_wlan device node. No authentication is needed beyond local access to the device. The attacker triggers the overflow by writing a crafted payload with an unusual size to the device file, leading to a heap-based buffer overflow [1].

Impact

Successful exploitation can result in a denial of service (system crash) or potentially arbitrary code execution. The impact may include kernel-level compromise, though the exact extent is unspecified [1].

Mitigation

Google addressed this vulnerability in the Android Security Bulletin for October 2016. Users should apply the latest security updates from their device manufacturer or update to a patched kernel version. No workaround is provided [1].