PT-2018-1967 · Qualcomm+1 · Qualcomm Trustzone+2

Published 2018-03-05 · Updated 2019-01-24 · CVE-2018-11999

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm TrustZone versions MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 636, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM630, SDM660, SDX24

Description The issue is related to insufficient input validation in the Qualcomm TrustZone component of the Android operating system. This can lead to a denial of service. The vulnerability affects various Snapdragon products, including automobile, mobile, and wear devices.

Recommendations For versions MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 636, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM630, SDM660, SDX24, consider disabling the TrustZone component until a patch is available. As a temporary workaround, restrict access to the TrustZone component to minimize the risk of exploitation. Avoid using the vulnerable TrustZone component in the affected Snapdragon products until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-01574

CVE-2018-11999

Affected Products

Android

Qualcomm Trustzone

Snapdragon

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-11999 · Security Note
• https://qualcomm.com/company/product-security/bulletins · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01574 · Security Note
• http://securityfocus.com/bid/106128 · Note
• https://source.android.com/security/bulletin/2018-12-01 · Note