CVE-2018-11299

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly in stats events then WLAN host driver tries to access interface array without proper bound check which can lead to invalid memory access and as a side effect kernel panic or page fault.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

http://www.securityfocus.com/bid/107770
https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=409d269c3464a84d9274bc0831031b2216b1060Patch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletinPatch, Third Party Advisory
http://www.securityfocus.com/bid/107770
https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=409d269c3464a84d9274bc0831031b2216b1060Patch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletinPatch, Third Party Advisory

Timeline

Published: Sep 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-11305.5Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that CVE-2018-113007.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, callback executed from the other CVE-2018-113017.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on buffer length w CVE-2018-113027.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received CVE-2018-113047.8Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that leads to integer overflo CVE-2018-113057.8When a series of FDAL messages are sent to the modem, a Use After Free condition can occur in Snapdragon Automobile, Snapdragon Mobile, Snap CVE-2018-113079.8An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBat CVE-2018-113099.8Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the Wo CVE-2018-11318.8Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with au CVE-2018-113119.1A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FT CVE-2018-113149.6The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device co CVE-2018-113156.5The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This