PT-2018-10840 · Qualcomm · Snapdragon Mobile

Publicado 2018-10-26 · Atualizado 2019-04-25 · CVE-2018-11828

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Snapdragon Mobile versions SD 205, SD 210, SD 212, SD 425, SD 430, SD 450, SD 625, SD 650, SD 652

Description The issue occurs when the firmware attempts to obtain a random MAC address generated from new software random number generator (RNG) and analog-to-digital converter (ADC) values, which are constant. This causes the device under test (DUT) to become stuck in a loop while trying to get random ADC samples.

Recommendations For Snapdragon Mobile versions SD 205, SD 210, SD 212, SD 425, SD 430, SD 450, SD 625, SD 650, SD 652, consider implementing a workaround to prevent the DUT from getting stuck in a loop, such as introducing variability in the ADC values or using an alternative random number generation method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-11828

Produtos afetados

Snapdragon Mobile

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11828 · Nota de Segurança
• http://securityfocus.com/bid/107681 · Nota
• https://qualcomm.com/company/product-security/bulletins · Aviso do Fabricante