PT-2018-6795 · Qualcomm · Snapdragon

Published 2018-10-23 · Updated 2019-10-03 · CVE-2017-18277

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835

Description: The issue occurs when dynamic memory allocation fails, causing the process to sleep for one second and then continue with an infinite loop without retrying for memory allocation. This affects various Qualcomm Snapdragon versions used in automobile, mobile, and wear devices.

Recommendations: For versions MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, consider implementing a retry mechanism for dynamic memory allocation to prevent infinite loops. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2017-18277

Affected Products

Snapdragon

References · 3

• https://qualcomm.com/company/product-security/bulletins · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18277 · Security Note
• https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components · Note