PT-2018-6830 · Qualcomm · Qualcomm Snapdragon Mobile

Publicado 2018-10-23 · Atualizado 2019-10-03 · CVE-2017-18312

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Automobile versions MSM8996AU Qualcomm Snapdragon Mobile versions SD 410/12, SD 617, SD 650/52, SD 810, SD 820, SD 820A

Description: The issue allows a third-party to manipulate a device and perform unauthorized operations due to the lack of checking of same state transitions while accessing SafeSwitch services.

Recommendations: For Qualcomm Snapdragon Automobile version MSM8996AU, update the software to include proper state transition checks to prevent unauthorized access. For Qualcomm Snapdragon Mobile versions SD 410/12, SD 617, SD 650/52, SD 810, SD 820, SD 820A, apply configuration changes to restrict unauthorized operations until a patch is available. As a temporary workaround, consider restricting access to SafeSwitch services until the issue is resolved.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2017-18312

Produtos afetados

Qualcomm Snapdragon Mobile

Referências · 3

• https://qualcomm.com/company/product-security/bulletins · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18312 · Nota de Segurança
• https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components · Nota