CVE-2018-9363

Hay un desbordamiento de enteros en hidp_process_report en bluetooth. Esto podría llevar a una escritura fuera de límites sin necesitar privilegios de ejecución adicionales. No se necesita interacción del usuario para explotarlo. Producto: Versiones de Android: Kernel de Android. Android ID: A-65853588. Referencias: Upstream kernel.

A buffer overflow due to a singed-unsigned comparsion was found in hidp_process_report() in the net/bluetooth/hidp/core.c in the Linux kernel. The buffer length is an unsigned int but gets cast to a signed int which in certain conditions can lead to a system panic and a denial-of-service.

Noam Rathaus discovered that a use-after-free vulnerability existed in the Infiniband implementation in the Linux kernel. An attacker could use this to cause a denial of service. It was discovered that an integer overflow existed in the CD-ROM driver of the Linux kernel. A local attacker could use this to expose sensitive information. It was discovered that an integer overflow existed in the HID Bluetooth implementation in the Linux kernel that could lead to a buffer overwrite. An attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.