Lucene search

QualcommCVE-2017-18128

HistoryApr 11, 2018 - 3:29 p.m.

CVE-2017-18128

2018-04-1115:29:00

qualcomm

web.nvd.nist.gov

android

qualcomm

snapdragon

vulnerability

security patch

access control

mpu

error correction

data exposure

nvd

cve-2017-18128

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

43.1%

JSON

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, improper access control while configuring MPU protecting error correction registers may potentially lead to exposure of related secured data.

Affected configurations

Nvd

Node

qualcommsd_845_firmwareMatch-

AND

qualcommsd_845Match-

Node

qualcommsd_850_firmwareMatch-

AND

qualcommsd_850Match-

VendorProductVersionCPE
qualcommsd_845_firmware-cpe:2.3:o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
qualcommsd_845-cpe:2.3:h:qualcomm:sd_845:-:*:*:*:*:*:*:*
qualcommsd_850_firmware-cpe:2.3:o:qualcomm:sd_850_firmware:-:*:*:*:*:*:*:*
qualcommsd_850-cpe:2.3:h:qualcomm:sd_850:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qualcomm	sd_845_firmware	-	cpe:2.3:o:qualcomm:sd_845_firmware:-:::::::*
qualcomm	sd_845	-	cpe:2.3:h:qualcomm:sd_845:-:::::::*
qualcomm	sd_850_firmware	-	cpe:2.3:o:qualcomm:sd_850_firmware:-:::::::*
qualcomm	sd_850	-	cpe:2.3:h:qualcomm:sd_850:-:::::::*

CNA Affected

[
  {
    "product": "Snapdragon Mobile",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "SD 845, SD 850"
      }
    ]
  }
]

References

www.securityfocus.com/bid/103671

source.android.com/security/bulletin/2018-04-01

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

43.1%

JSON

Related for CVE-2017-18128