CVE-2017-14877
Last modified
CVE-2017-14877 is a vulnerability of currently unknown severity. While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPA_IOC_QUERY_RT_TBL_INDEX while another sends an ioctl cmd IPA_IOC_DEL_RT_RULE, a use-after-free condition may occur.. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPA_IOC_QUERY_RT_TBL_INDEX while another sends an ioctl cmd IPA_IOC_DEL_RT_RULE, a use-after-free condition may occur.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | All versions |
References
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=ca395c15c49cf6463a39d197b6a9331d183d94cbPatch, Third Party Advisory
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=ca395c15c49cf6463a39d197b6a9331d183d94cbPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14877?
How severe is CVE-2017-14877?
How do I fix CVE-2017-14877?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14870In Android for MSM, Firefox OS for MSM, QRD Android, with al…
- CVE-2017-14872While flashing a meta image, a buffer over-read can potentia…
- CVE-2017-14873In Android for MSM, Firefox OS for MSM, QRD Android, with al…
- CVE-2017-14874Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-14875In the handler for the ioctl command VIDIOC_MSM_ISP_DUAL_HW_…
- CVE-2017-14876In msm_ispif_config_stereo() in Android for MSM, Firefox OS …
- CVE-2017-14878In Android for MSM, Firefox OS for MSM, QRD Android, with al…
- CVE-2017-14879In Android for MSM, Firefox OS for MSM, QRD Android, with al…
- CVE-2017-1488An undisclosed vulnerability in Jazz common products exists …3.7
- CVE-2017-14880In Qualcomm Android for MSM, Firefox OS for MSM, and QRD And…
- CVE-2017-14881While calling the IPA IOCTL handler for IPA_IOC_ADD_HDR_PROC…
- CVE-2017-14882In Android for MSM, Firefox OS for MSM, QRD Android, with al…
Are you affected by CVE-2017-14877?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST