In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in widevine_dash_cmd_handler(), rsp buffers are passed off to widevine commands. These rsp buffers have values in them, such as buffer lengths, that need to be validated to ensure that no buffer overflow/over-reads happen. However, rsp buffers are not always in locked memory, meaning a time-of-check, time-of-use issue can occur where we check that the value is valid, but then a race condition occurs where this memory is swapped out with a different, possibly out of range, value.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: qualcomm

Published: 2018-04-18T14:00:00Z

Updated: 2024-09-16T19:00:25.710Z

Reserved: 2017-08-16T00:00:00

Link: CVE-2015-9157

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2018-04-18T14:29:05.403

Modified: 2018-05-10T16:36:00.103

Link: CVE-2015-9157

cve-icon Redhat

No data.