tree 4be879e3229f15947968125ed7833f4ca0e11a1f
parent 56cb8a58e31ad45e5792f6c7327b9eea615e0e8e
author Peter Lee <peter.lee@hi-p.com> 1477298075 +0800
committer Teemu Hukkanen <teemu@fairphone.com> 1479556874 +0100

FPII-2516 : Elevation of privilege vulnerability in Qualcomm camera driver CVE-2016-6740 A-30143904

High

An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

Additional technical details:

A-30143904
(Qualcomm ref#: CR#1056307)
There is a possible stack overflow vulnerability in the msm_camera_qup_i2c_write_seq function because the size of the variable length array on the stack is acquired from user space.

The fix is designed to add additional bounds checks to prevent the potential stack overflow vulnerability.

Link to publicly available patch:
Qualcomm patch: CR 1056307: https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=ef78bd62f0c064ae4c827e158d828b2c110ebcdc

Change-Id: I030d623e4f10b6eb5ab8a65d889f1622191857c9