PT-2017-2121 · Qualcomm · Qualcomm Secure Execution Environment

Published 2017-05-16 · Updated 2017-07-11 · CVE-2015-9002

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Secure Execution Environment versions (affected versions not specified)

Description The issue is related to errors in number processing within the TrustZone technology, specifically in the DRM subroutine of the Qualcomm Secure Execution Environment microprogram for Android from the CAF repository. This could potentially allow a remote attacker to elevate their privileges. An out-of-range pointer offset vulnerability can occur in a DRM routine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2017-01298

CVE-2015-9002

Affected Products

Qualcomm Secure Execution Environment

References · 5

• https://source.android.com/security/bulletin/2017-04-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-9002 · Security Note
• https://bdu.fstec.ru/vul/2017-01298 · Security Note
• http://securitytracker.com/id/1038201 · Note
• http://securityfocus.com/bid/97329 · Note