In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, the response pointer passed from user space to SDMX_process is not checked before it is used. If the given response buffer length is smaller than 16 bytes, the response values will be written to a memory outside the buffer, possibly in the secure memory area.
Problem Types
| Type | CWE ID | Description |
|---|
| text | N/A | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Core. |
Type: text
CWE ID: N/A
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Core.
Metrics
| Version | Base score | Base severity | Vector |
|---|