Lucene search

K
cveQualcommCVE-2019-2278
HistoryJul 25, 2019 - 5:15 p.m.

CVE-2019-2278

2019-07-2517:15:12
CWE-347
qualcomm
web.nvd.nist.gov
29
keystore
signature
boot
bypass
snapdragon
security
vulnerability
cve-2019-2278
nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0

Percentile

12.6%

User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660

Affected configurations

Nvd
Node
qualcommmdm9607_firmwareMatch-
AND
qualcommmdm9607Match-
Node
qualcommmdm9640_firmwareMatch-
AND
qualcommmdm9640Match-
Node
qualcommsd_425_firmwareMatch-
AND
qualcommsd_425Match-
Node
qualcommsd_427_firmwareMatch-
AND
qualcommsd_427Match-
Node
qualcommsd_430_firmwareMatch-
AND
qualcommsd_430Match-
Node
qualcommsd_435_firmwareMatch-
AND
qualcommsd_435Match-
Node
qualcommsd_450_firmwareMatch-
AND
qualcommsd_450Match-
Node
qualcommsd_625_firmwareMatch-
AND
qualcommsd_625Match-
Node
qualcommsd_636_firmwareMatch-
AND
qualcommsd_636Match-
Node
qualcommsd_712_firmwareMatch-
AND
qualcommsd_712Match-
Node
qualcommsd_710_firmwareMatch-
AND
qualcommsd_710Match-
Node
qualcommsd_670_firmwareMatch-
AND
qualcommsd_670Match-
Node
qualcommsd_845_firmwareMatch-
AND
qualcommsd_845Match-
Node
qualcommsd_850_firmwareMatch-
AND
qualcommsd_850Match-
Node
qualcommsdm660_firmwareMatch-
AND
qualcommsdm660Match-
VendorProductVersionCPE
qualcommmdm9607_firmware-cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcommmdm9607-cpe:2.3:h:qualcomm:mdm9607:-:*:*:*:*:*:*:*
qualcommmdm9640_firmware-cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*
qualcommmdm9640-cpe:2.3:h:qualcomm:mdm9640:-:*:*:*:*:*:*:*
qualcommsd_425_firmware-cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
qualcommsd_425-cpe:2.3:h:qualcomm:sd_425:-:*:*:*:*:*:*:*
qualcommsd_427_firmware-cpe:2.3:o:qualcomm:sd_427_firmware:-:*:*:*:*:*:*:*
qualcommsd_427-cpe:2.3:h:qualcomm:sd_427:-:*:*:*:*:*:*:*
qualcommsd_430_firmware-cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
qualcommsd_430-cpe:2.3:h:qualcomm:sd_430:-:*:*:*:*:*:*:*
Rows per page:
1-10 of 301

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660"
      }
    ]
  }
]

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0

Percentile

12.6%

Related for CVE-2019-2278