CVE-2018-9373
Published: 28 January 2025
Description
In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2018-9373 is a vulnerability in the TdlsexRxFrameHandle function of the MTK WLAN driver, where a missing bounds check enables an out-of-bounds write (CWE-787). This issue affects the MTK WLAN driver component, as documented in Android security resources.
The vulnerability allows exploitation over an adjacent network (AV:A) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). A successful attack leads to remote escalation of privilege without additional execution privileges, impacting confidentiality, integrity, and availability at a high level (C:H/I:H/A:H) and yielding a CVSS v3.1 base score of 8.8.
The Android security bulletin dated June 1, 2018 (https://source.android.com/security/bulletin/2018-06-01) addresses this vulnerability, providing patch details for mitigation in affected Android releases.
Details
- CWE(s)