CVE-2018-5820

Vulnerability

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, the function wma_tbttoffset_update_event_handler() receives a parameter from firmware that is used to allocate memory for a local buffer. This parameter is not properly validated, which can result in an integer overflow. The overflow subsequently leads to a heap overwrite [1].

Exploitation

An attacker must be able to supply a crafted parameter to the firmware interface that triggers the vulnerable code path. The attacker does not require authentication but needs the ability to send malicious firmware data. By providing a value that causes an integer overflow during the memory allocation calculation, the attacker can overwrite heap memory beyond the intended buffer.

Impact

Successful exploitation results in a heap overwrite, which can corrupt kernel memory. This may lead to arbitrary code execution in the kernel context, potentially allowing full compromise of the device's confidentiality, integrity, and availability.

Mitigation

The issue is fixed in the Android security patch level 2018-04-05, as documented in the Pixel/Nexus Security Bulletin [1]. Users should apply the latest security updates from their device manufacturer. No workaround is available for unpatched devices.