CVE-2017-11089

Vulnerability

A buffer overread vulnerability exists in the nl80211_set_station function in affected Android Linux kernel versions from CAF. This occurs when a user-space application sends the attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data smaller than 4 bytes, leading to an out-of-bounds read. Affected platforms include Android for MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel [1].

Exploitation

An attacker with the ability to send crafted netlink messages from user space can trigger the overread. This requires local access or a user-space application that can issue the appropriate NL80211_CMD_SET_STATION command with a malformed NL80211_ATTR_LOCAL_MESH_POWER_MODE attribute. No authentication or special privileges are needed beyond the ability to interact with the kernel netlink socket [1].

Impact

Successful exploitation results in a kernel buffer overread, which could leak sensitive kernel memory information to the attacker. The vulnerability is rated as High severity (CVSS v3: 7.5) due to the potential for information disclosure, though it does not directly lead to code execution or privilege escalation [1].

Mitigation

A fix was included in the November 2017 Pixel/Nexus Security Bulletin and corresponding Android security patches. Users should apply the latest security updates from their device manufacturer. No workarounds are documented. The vulnerability is not listed on the CISA KEV catalog [1].