CVE-2015-0571

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted application, related to wlan_hdd_hostapd.c and wlan_hdd_wext.c.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://source.android.com/security/bulletin/2016-05-01.htmlVendor Advisory
http://www.securityfocus.com/bid/77691Third Party Advisory, VDB Entry
https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015Broken Link
http://source.android.com/security/bulletin/2016-05-01.htmlVendor Advisory
http://www.securityfocus.com/bid/77691Third Party Advisory, VDB Entry
https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015Broken Link

Timeline

Published: May 9, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-05727.0Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used CVE-2015-05739.8drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android CVE-2015-05749.8In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient.CVE-2015-05759.8In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configura CVE-2015-05767.0In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in HSDPA.CVE-2015-05774.3Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS, as used on the Cisco Email CVE-2015-05785.7Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (d CVE-2015-05795.0Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU CVE-2015-05806.5Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patc CVE-2015-05817.5The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of ser CVE-2015-05825.0The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted tra CVE-2015-05835.0Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via