Google Android Key Length csr_update_fils_params_rso integer underflow

Summaryinfo

A vulnerability marked as critical has been reported in Google Android. Impacted is the function csr_update_fils_params_rso of the component Key Length Handler. Performing a manipulation results in integer underflow. This vulnerability is known as CVE-2018-5850. Attacking locally is a requirement. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability classified as critical has been found in Google Android (Smartphone Operating System) (the affected version is unknown). This affects the function csr_update_fils_params_rso of the component Key Length Handler. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the function csr_update_fils_params_rso(), insufficient validation on a key length can result in an integer underflow leading to a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

The bug was discovered 05/11/2018. The weakness was published 06/06/2018 (Website). The advisory is shared at source.android.com. This vulnerability is uniquely identified as CVE-2018-5850 since 01/19/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/15/2020). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 26 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

Similar entries are available at VDB-117573, VDB-117574, VDB-119006 and VDB-119016. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion