CVE-2018-5836

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In wma_nan_rsp_event_handler() in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, the data_len value is received from firmware and not properly validated which could potentially lead to an out-of-bounds access.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Jul 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-58377.5In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205,CVE-2018-58387.8Improper Validation of Array Index In the adreno OpenGL driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, an out-of-bo CVE-2018-58397.1Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Sna CVE-2018-58407.8Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android releases from CAF (And CVE-2018-58417.8dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lea CVE-2018-58427.8An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (An CVE-2018-58437.8In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using th CVE-2018-58447.8In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all Android releases fro CVE-2018-58457.0A race condition in drm_atomic_nonblocking_commit() in the display driver can potentially lead to a Use After Free scenario in all Android r CVE-2018-58467.8A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD/IPA_IOC_NOTIFY_WAN_UPST CVE-2018-58477.8Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF (Android for MSM, Fi CVE-2018-58487.8In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of t