PT-2018-10840 · Qualcomm · Snapdragon Mobile

Published 2018-10-26 · Updated 2019-04-25 · CVE-2018-11828

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Snapdragon Mobile versions SD 205, SD 210, SD 212, SD 425, SD 430, SD 450, SD 625, SD 650, SD 652

Description The issue occurs when the firmware attempts to obtain a random MAC address generated from new software random number generator (RNG) and analog-to-digital converter (ADC) values, which are constant. This causes the device under test (DUT) to become stuck in a loop while trying to get random ADC samples.

Recommendations For Snapdragon Mobile versions SD 205, SD 210, SD 212, SD 425, SD 430, SD 450, SD 625, SD 650, SD 652, consider implementing a workaround to prevent the DUT from getting stuck in a loop, such as introducing variability in the ADC values or using an alternative random number generation method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-11828

Affected Products

Snapdragon Mobile

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11828 · Security Note
• https://qualcomm.com/company/product-security/bulletins · Vendor Advisory
• http://securityfocus.com/bid/107681 · Note