PT-2018-5512 · Qualcomm · Msm8909W+31

Published 2018-01-12 · Updated 2018-07-19 · CVE-2017-13218

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions (affected versions not specified) FSM9055 (affected versions not specified) IPQ4019 (affected versions not specified) IPQ8064 (affected versions not specified) MDM9206 (affected versions not specified) MDM9607 (affected versions not specified) MDM9635M (affected versions not specified) MDM9640 (affected versions not specified) MDM9650 (affected versions not specified) MSM8909W (affected versions not specified) QCA4531 (affected versions not specified) QCA9980 (affected versions not specified) QCN5502 (affected versions not specified) SD 210/SD 212/SD 205 (affected versions not specified) SD 410/12 (affected versions not specified) SD 425 (affected versions not specified) SD 430 (affected versions not specified) SD 450 (affected versions not specified) SD 615/16/SD 415 (affected versions not specified) SD 617 (affected versions not specified) SD 625 (affected versions not specified) SD 650/52 (affected versions not specified) SD 810 (affected versions not specified) SD 820 (affected versions not specified) SD 820A (affected versions not specified) SD 835 (affected versions not specified) SD 845 (affected versions not specified)

Description: Access to CNTVCT EL0 in certain Qualcomm products could be used for side channel attacks, potentially leading to local information disclosure without requiring additional execution privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-13218

Affected Products

Fsm9055

Ipq4019

Ipq8064

Mdm9206

Mdm9607

Mdm9635M

Mdm9640

Mdm9650

Msm8909W

Qca4531

Qca9980

Qcn5502

Qualcomm Snapdragon

Sd 205

Sd 210

Sd 212

Sd 410

Sd 415

Sd 425

Sd 430

Sd 450

Sd 615

Sd 616

Sd 617

Sd 625

Sd 650

Sd 652

Sd 810

Sd 820

Sd 820A

Sd 835

Sd 845

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-13218 · Security Note
• https://source.android.com/security/bulletin/2018-01-01 · Vendor Advisory
• http://securitytracker.com/id/1040106 · Note
• https://codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin · Note
• http://securityfocus.com/bid/102390 · Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Note