Qualcomm Atheros Universal WLAN Kernel Memory Disclosure

CVE-2019-10618: Kernel Memory Disclosure

Tenable has discovered vulnerabilities in Qualcomm Atheros Universal WLAN Driver Service affecting Qcamain10x64.sys version 12.0.0.910 and below. The vulnerability can allow a malicious low privileged user mode process to disclose kernel memory as well a sysem-wide Denial of Service (DoS). This is due to improper probe-for-read checks on buffers passed from user mode. The vulnerability can be observed by sending specific IOCTLs and buffers to the "ATH_WIFIDEV.00" device. 

The following 2 IOCTLs result in DoS (BSOD) if combined with NULL input buffers:

• IOCTL_EVENT_OBJECT 0x220203 // Doesn't validate input buffer
• IOCTL_PPDULOG_CMD 0x220207 // Doesn't validate input buffer

The following two IOCTLs can trigger kernel memory disclosure:

• IOCTL_SET_POWER_LIMIT 0x22020B // Doesn't validate input buffer
• IOCTL_GET_PCI_DATA 0x220043 // Doesn't validate input buffer

The kernel memory leak can be triggered by sending IOCTL_SET_POWER_LIMIT with an input buffer in kernel memory range. This will cause power level to be set to what ever is in that kernel memory buffer. This can be read back by an attacker using "get_tx_power" command via IOCTL of 0x220183. The same can be done using IOCTL_GET_PCI_DATA with a kernel memory input buffer.

https://github.com/tenable/poc/blob/master/Qualcomm/Atheros/QcomWlanSrv/cve-2019-10618.cpp