CVE-2017-14890

Vulnerability

The vulnerability resides in the Qualcomm WLAN driver function wma_send_bcn_buf_ll(). When processing an SWBA (Software Beacon Alert) event, the vdev_map value is not properly validated before being used as an index, leading to a potential buffer overwrite. This affects Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 [1].

Exploitation

An attacker with local system access and the ability to inject crafted SWBA events into the WLAN firmware could trigger this vulnerability. No user interaction is required beyond having the WLAN driver active. By controlling the vdev_map value, the attacker can write beyond the allocated buffer boundaries.

Impact

Successful exploitation allows an attacker to corrupt adjacent memory, potentially leading to a denial-of-service condition or arbitrary code execution in the context of the kernel. This can result in local privilege escalation and full compromise of the affected device [1].

Mitigation

The issue was fixed in the Android security patch level 2018-04-05. Users should ensure their devices receive the April 2018 security update or later. No workaround is provided if the patch cannot be applied [1].