CVE-2018-11276

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-componentsPatch, Vendor Advisory
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=83a44ca6057bf9c1e36515cded28edc32a4a1501Patch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletinPatch, Third Party Advisory
https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-componentsPatch, Vendor Advisory
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=83a44ca6057bf9c1e36515cded28edc32a4a1501Patch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletinPatch, Third Party Advisory

Timeline

Published: Sep 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-112777.8In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD CVE-2018-112787.1In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Venus HW searches for start code CVE-2018-112798.8Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and CVE-2018-11287.5It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker havi CVE-2018-112805.5In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space ther CVE-2018-112817.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while calling IPA_IOC_MDFY_RT_RU CVE-2018-112849.3Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with th CVE-2018-112857.8In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD CVE-2018-112867.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing global variable CVE-2018-112879.8In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD CVE-2018-112887.8Possible undefined behavior due to lack of size check in function for parameter segment_idx can lead to a read outside of the intended regio CVE-2018-112897.8Data truncation during higher to lower type conversion which causes less memory allocation than desired can lead to a buffer overflow in Sna