Vulnerability CVE-2014-4323

Vulnerability CVE-2014-4323

Published: 2014-12-12

Description:

The mdp_lut_hw_update function in drivers/video/msm/mdp.c in the MDP display driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain start and length values within an ioctl call, which allows attackers to gain privileges via a crafted application.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Linux Kernel Qualcomm Innovation Center (QuIC) Android gain privileges	quicinc	14.12.2014

Type:

CWE-264

(Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Linux -> Linux kernel

References:

https://www.codeaurora.org/projects/security-advisories/improper-input-validation-mdp-driver-when-processing-color-maps

Copyright 2024, cxsecurity.com