Vulnerability Details : CVE-2018-5856
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use After Free condition can occur in Audio.
Vulnerability category: Memory Corruption
Products affected by CVE-2018-5856
- cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-5856
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 17 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-5856
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.1
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:C |
3.9
|
8.5
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2018-5856
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-5856
-
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=3b666735fcc49f5cd3a63440fdc0667ae9316f17
kernel/msm-3.18 - Unnamed repository; edit this file 'description' to name the repository.Patch;Third Party Advisory
-
https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
Page not found - Code AuroraPatch;Third Party Advisory
-
https://source.codeaurora.org/quic/la/platform/vendor/opensource/audio-kernel/commit/?id=7ab92dd2952d59f3c15c856effe94bba1858e3ff
platform/vendor/opensource/audio-kernel - Unnamed repositoryPatch;Third Party Advisory
Jump to