Lucene search

K
cve[email protected]CVE-2017-18141
HistoryJan 03, 2019 - 3:29 p.m.

CVE-2017-18141

2019-01-0315:29:00
web.nvd.nist.gov
24
cve
2017
18141
tee
snapdragon
security
vulnerability
access

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0

Percentile

12.6%

When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016.

Affected configurations

NVD
Node
qualcommipq8074_firmwareMatch-
AND
qualcommipq8074Match-
Node
qualcommmdm9206_firmwareMatch-
AND
qualcommmdm9206Match-
Node
qualcommmdm9607_firmwareMatch-
AND
qualcommmdm9607Match-
Node
qualcommmdm9635m_firmwareMatch-
AND
qualcommmdm9635mMatch-
Node
qualcommmdm9650_firmwareMatch-
AND
qualcommmdm9650Match-
Node
qualcommmdm9655_firmwareMatch-
AND
qualcommmdm9655Match-
Node
qualcommmsm8996au_firmwareMatch-
AND
qualcommmsm8996auMatch-
Node
qualcommsd_210_firmwareMatch-
AND
qualcommsd_210Match-
Node
qualcommsd_212_firmwareMatch-
AND
qualcommsd_212Match-
Node
qualcommsd_205_firmwareMatch-
AND
qualcommsd_205Match-
Node
qualcommsd_410_firmwareMatch-
AND
qualcommsd_410Match-
Node
qualcommsd_412_firmwareMatch-
AND
qualcommsd_412Match-
Node
qualcommsd_425_firmwareMatch-
AND
qualcommsd_425Match-
Node
qualcommsd_427_firmwareMatch-
AND
qualcommsd_427Match-
Node
qualcommsd_430_firmwareMatch-
AND
qualcommsd_430Match-
Node
qualcommsd_435_firmwareMatch-
AND
qualcommsd_435Match-
Node
qualcommsd_439_firmwareMatch-
AND
qualcommsd_439Match-
Node
qualcommsd_429_firmwareMatch-
AND
qualcommsd_429Match-
Node
qualcommsd_450_firmwareMatch-
AND
qualcommsd_450Match-
Node
qualcommsd_625_firmwareMatch-
AND
qualcommsd_625Match-
Node
qualcommsd_632_firmwareMatch-
AND
qualcommsd_632Match-
Node
qualcommsd_636_firmwareMatch-
AND
qualcommsd_636Match-
Node
qualcommsd_650_firmwareMatch-
AND
qualcommsd_650Match-
Node
qualcommsd_652_firmwareMatch-
AND
qualcommsd_652Match-
Node
qualcommsd_810_firmwareMatch-
AND
qualcommsd_810Match-
Node
qualcommsd_820_firmwareMatch-
AND
qualcommsd_820Match-
Node
qualcommsd_820a_firmwareMatch-
AND
qualcommsd_820aMatch-
Node
qualcommsd_835_firmwareMatch-
AND
qualcommsd_835Match-
Node
qualcommsda660_firmwareMatch-
AND
qualcommsda660Match-
Node
qualcommsdm439_firmwareMatch-
AND
qualcommsdm439Match-
Node
qualcommsdm630_firmwareMatch-
AND
qualcommsdm630Match-
Node
qualcommsdm660_firmwareMatch-
AND
qualcommsdm660Match-
Node
qualcommsdx24_firmwareMatch-
AND
qualcommsdx24Match-
Node
qualcommsnapdragon_high_med_2016_firmwareMatch-
AND
qualcommsnapdragon_high_med_2016Match-
VendorProductVersionCPE
qualcommipq8074_firmware-cpe:/o:qualcomm:ipq8074_firmware:-:::

CNA Affected

[
  {
    "product": "Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016"
      }
    ]
  }
]

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0

Percentile

12.6%

Related for CVE-2017-18141