description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, by calling an IPA ioctl and searching for routing/filer/hdr rule handle from ipa_idr pointer using ipa_idr_find() function, the wrong structure pointer can be returned resulting in a slab out of bound access in the IPA driver.
problem types: Use of Out-of-range Pointer Offset in IPA
affected:
{
product: Android for MSM, Firefox OS for MSM, QRD Android
vendor: Qualcomm, Inc.
versions:
status: affected, version: All Android releases from CAF using the Linux kernel
}