CVE-2018-5886

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A pointer in an ADSPRPC command is not properly validated in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android), which can lead to kernel memory being accessed.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=97017d59158086689488bdcfcafb59654a6f10daPatch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinThird Party Advisory
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=97017d59158086689488bdcfcafb59654a6f10daPatch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinThird Party Advisory

Timeline

Published: Jul 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-58877.8While processing the USB StrSerialDescriptor array, an array index out of bounds can occur in Android releases from CAF using the linux kern CVE-2018-58887.8While processing the system path, an out of bounds access can occur in Android releases from CAF using the linux kernel (Android for MSM, Fi CVE-2018-58897.8While processing a compressed kernel image, a buffer overflow can occur in Android releases from CAF using the linux kernel (Android for MSM CVE-2018-58907.8If the fdt_totalsize is reported as 0 for the current device tree, it bypasses an error check for a valid device tree in Android releases fr CVE-2018-58918.4While processing modem SSR after IMS is registered, the IMS data daemon is restarted but the ipc_dataHandle is no longer available. Conseque CVE-2018-58927.5The Touch Pal application can collect user behavior data without awareness by the user in Snapdragon Mobile and Snapdragon Wear.CVE-2018-58937.8While processing a message from firmware in htt_t2h_msg_handler_fast() in Android releases from CAF using the linux kernel (Android for MSM,CVE-2018-58946.5Improper Validation of Array Index in Multimedia While parsing an mp4 file in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, CVE-2018-58955.5Buffer over-read may happen in wma_process_utf_event() due to improper buffer length validation before writing into param_buf->num_wow_packe CVE-2018-58967.1In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-0 CVE-2018-58977.5While reading the data from buffer in dci_process_ctrl_status() there can be buffer over-read problem if the len is not checked correctly in CVE-2018-58987.8Integer overflow can occur in msm_pcm_adsp_stream_cmd_put() function if the user supplied data "param_length" goes beyond certain limit in A