LiveActive security incident?Get immediate response
CVE Record

CVE-2017-18060: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux ker...

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_id in wma_unified_bcntx_status_event_handler(), which is received from firmware, leads to potential out of bounds memory read.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a kernel-side Android/Qualcomm WLAN issue where a value coming from firmware was not properly checked before use. The documented impact is a potential out-of-bounds memory read. The public bundle does not provide CVSS, confirmed exploitation, or a complete affected product list.

Executive priority

Treat this as an inventory and patch verification item for legacy Qualcomm-based Android fleets. Urgency is constrained by missing severity and exploitation evidence, but kernel WLAN memory issues warrant attention on managed or unsupported devices.

Technical view

CVE-2017-18060 concerns improper validation of resp_event->vdev_id in wma_unified_bcntx_status_event_handler() in Android for MSM/CAF Linux kernel WLAN code. The value is received from firmware and may cause an out-of-bounds memory read. Public evidence points to a CodeAurora qcacld-3.0 commit and the March 2018 Pixel bulletin.

Likely exposure

Likely exposure is limited to Android or related builds using the Qualcomm CAF/MSM Linux kernel WLAN driver lineage referenced in the CVE. Exact OEM devices, versions, and CPEs are not provided in the source bundle.

Exploitation context

There is no KEV listing and no cited source in the bundle confirms active exploitation. The available description suggests the issue is triggered through a firmware-originated WLAN event, but does not establish remote, local, or pre-auth exploitability.

Researcher notes

The public evidence is sparse: no CVSS, CWE, CPEs, exploit status, or fixed version matrix is included. Researchers should anchor conclusions to the CodeAurora commit, Pixel bulletin, and OEM BSPs before asserting exposure or remediation completeness.

Mitigation direction

  • Check OEM, Qualcomm, or Android bulletin guidance for CVE-2017-18060 applicability.
  • Apply vendor security updates that include the March 2018 Android/Pixel bulletin fixes, where applicable.
  • Prioritize unsupported Qualcomm Android devices for replacement or compensating controls.
  • Track affected device models through vendor advisories rather than assuming coverage from CVE metadata.

Validation and detection

  • Identify Android devices or firmware builds based on Qualcomm CAF/MSM WLAN kernel code.
  • Check whether vendor advisories or patch notes reference CVE-2017-18060.
  • Review BSP/kernel source for the referenced qcacld-3.0 fix or equivalent validation.
  • Confirm device Android security patch levels against OEM guidance for March 2018 fixes.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-18060 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.