CVE-2015-0571
The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted application, related to wlan_hdd_hostapd.c and wlan_hdd_wext.c.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- linux/linux kernel
- Source
- cve@mitre.org
References
- http://source.android.com/security/bulletin/2016-05-01.htmlVendor Advisory
- http://www.securityfocus.com/bid/77691Third Party Advisory, VDB Entry
- https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015Broken Link
- http://source.android.com/security/bulletin/2016-05-01.htmlVendor Advisory
- http://www.securityfocus.com/bid/77691Third Party Advisory, VDB Entry
- https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.