Security readout for executives and security teams
Plain-English summary
This CVE describes a Qualcomm wireless/kernel issue in CAF-derived Android and related MSM platforms. A value used while processing an SWBA event was not properly checked, which could cause a buffer overwrite. Public sources do not provide CVSS, exploitation evidence, or detailed impact.
Executive priority
Treat this as a legacy mobile platform hygiene issue unless affected devices remain in production. Urgency increases where outdated Qualcomm-based Android devices support sensitive operations or cannot be patched.
Technical view
In wma_send_bcn_buf_ll(), the vdev_map value was not properly validated during SWBA event processing. The CVE scope is Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android releases from CAF using a Linux kernel before Android security patch level 2018-04-05.
Likely exposure
Exposure is most likely in older Qualcomm MSM or CAF-derived Android builds that did not receive the 2018-04-05 security patch level. Modern supported devices are less likely exposed if vendor firmware updates were applied.
Exploitation context
The provided sources do not state active exploitation, public exploit availability, attack prerequisites, or required privileges. CISA KEV status is false in the bundle, so active exploitation should not be assumed.
Researcher notes
The public record identifies a buffer overwrite condition but lacks CVSS, CWE, exploitability detail, and precise affected chipset lists. Validation should rely on vendor patch level and platform lineage, not CVE text alone.
Mitigation direction
- Update affected devices to Android security patch level 2018-04-05 or later.
- Check OEM and Qualcomm guidance for device-specific firmware availability.
- Retire or isolate unsupported CAF-derived builds that cannot receive fixes.
- Prioritize internet-connected or high-value mobile fleets for patch verification.
Validation and detection
- Inventory devices using Qualcomm MSM or CAF-derived Android kernels.
- Check each device's Android security patch level against 2018-04-05.
- Confirm OEM firmware release notes include the April 2018 Android security fixes.
- Review legacy QRD Android or Firefox OS for MSM assets separately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14890 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/pixel/2018-04-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.