CVE-2018-5832

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, a Use After Free condition can occur.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-416

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

https://source.android.com/security/bulletin/pixel/2018-06-01#qualcomm-componentsThird Party Advisory
https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinThird Party Advisory
https://source.android.com/security/bulletin/pixel/2018-06-01#qualcomm-componentsThird Party Advisory
https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinThird Party Advisory

Timeline

Published: Jul 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-58347.8In __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur in Android releases from CAF using the linux kernel (Android CVE-2018-58357.8If the seq_len is greater then CSR_MAX_RSC_LEN, a buffer overflow in __wlan_hdd_cfg80211_add_key() may occur when copying keyRSC in Android CVE-2018-58365.5In wma_nan_rsp_event_handler() in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before CVE-2018-58377.5In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205,CVE-2018-58387.8Improper Validation of Array Index In the adreno OpenGL driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, an out-of-bo CVE-2018-58397.1Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Sna CVE-2018-58407.8Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android releases from CAF (And CVE-2018-58417.8dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lea CVE-2018-58427.8An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (An CVE-2018-58437.8In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using th CVE-2018-58447.8In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all Android releases fro CVE-2018-58457.0A race condition in drm_atomic_nonblocking_commit() in the display driver can potentially lead to a Use After Free scenario in all Android r