CVE-2018-5834

Vulnerability

In __wlan_hdd_cfgopt_vendor_scan() in the WLAN host driver, a buffer overwrite can potentially occur in Android releases from CAF (Code Aurora Forum) using the Linux kernel. The affected versions include Android for MSM, Firefox OS for MSM, and QRD Android before the security patch level 2018-06-05. The bug can be triggered via a vendor-specific scan command [1].

Exploitation

An attacker needs to be able to interact with the affected device through a wireless interface or an app that can send vendor-specific NL80211 commands. No special authentication is required beyond normal access to the radio layer. By crafting a malicious vendor scan request with oversized data, the attacker can trigger a buffer overwrite [1].

Impact

Successful exploitation leads to a buffer overflow in kernel memory, which can result in arbitrary code execution in the kernel context. This gives the attacker full control over the device's operating system, compromising all confidentiality, integrity, and availability [1].

Mitigation

Google's Android Security Bulletin for June 2018 lists this issue as fixed. Qualcomm released a patch for the driver, and the fix was integrated into the Android security patch level 2018-06-05. Devices that have not received this patch remain vulnerable. No workaround is documented [1].