PT-2018-10872 · Qualcomm · Qualcomm Snapdragon Mobile

Published 2018-10-29 · Updated 2019-04-03 · CVE-2018-11871

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Automobile versions IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon High Med 2016

Description A buffer overwrite can occur in the WLAN function while processing the set pdev parameter command due to a lack of input validation. This issue affects various Qualcomm Snapdragon products, including Automobile, Mobile, and Wear versions.

Recommendations For Qualcomm Snapdragon Automobile versions IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon High Med 2016, consider implementing input validation for the set pdev parameter command to prevent buffer overwrites. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-11871

Affected Products

Qualcomm Snapdragon Mobile

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11871 · Security Note
• https://qualcomm.com/company/product-security/bulletins · Vendor Advisory
• http://securityfocus.com/bid/107681 · Note