CVE-2018-11849: Improper Restriction of Operations within the Bounds of a Memory Buffer

Lack of check on out of range of bssid parameter When processing scan start command will lead to buffer flow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU,...

CVE-2018-5866: Improper Restriction of Operations within the Bounds of a Memory Buffer

While processing logs, data is copied into a buffer pointed to by an untrusted pointer in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, SDA660...

CVE-2017-18124: Improper Restriction of Operations within the Bounds of a Memory Buffer

During secure boot, addition is performed on uint8 ptrs which led to overflow issue in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD...

CVE-2017-18300

Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SDA660...

CVE-2017-18292

Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 80...

CVE-2017-18298

Lack of Input Validation in SDMX API can lead to NULL pointer access in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD...

Code injection

When a particular GPIO is protected by blocking access to the corresponding GPIO resource registers, the protection can be bypassed using the corresponding banked GPIO registers instead in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 43...

Design/Logic Flaw

XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is not blown in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835...

CVE-2017-18282

Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660...

CVE-2017-18277

When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD...

CVE-2017-18293

Overview: CVE-2017-18293 describes a local vulnerability in Qualcomm/Snapdragon GPIO handling where blocking access to GPIO resource registers can be bypassed via banked GPIO registers, affecting Snapdragon Mobile and Snapdragon Wear devices (MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 425, SD ...

CVE-2017-18313

CVE-2017-18313 affects Qualcomm Snapdragon platforms where DirectX/ DXE memory (DXE-accessible memory) is within the authenticated image, enabling potential access to tamper with the WCNSS firmware stored in DDR. Affected devices include Snapdragon Mobile and Wear variants across MSM8909W, SD 210...

CVE-2017-18304

CVE-2017-18304 involves Insufficient memory allocation in boot due to an incorrect size being passed, causing out-of-bounds access. The affected devices span Qualcomm Snapdragon-family platforms and SoCs, including Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear acro...

CVE-2017-18313

Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channels to tamper with the authenticated WCNSS firmware stored in DDR because DXE-accessible memory is located within the authenticated image in Snapdragon Mobile and Snapdragon Wear in version MSM8909W,...

CVE-2017-18277

CVE-2017-18277 describes a memory allocation failure in Qualcomm closed‑source components (Snapdragon Auto/Mobile/Wear) across multiple SD/SoC generations (e.g., SD 210/212/205, 625, 650, 810, 820, 835; MDM9xxx, QCN5502, etc.). The bug behavior is that when dynamic memory allocation fails, the pr...

CVE-2017-18292

CVE-2017-18292 affects Qualcomm Snapdragon devices (MSM8909W, MSM8996AU, SD 210/212/205, 410/12, 425, 430, 450, 615/16/SD 415, 617, 625, 650/52, 800, 810, 820, 820A) across Snapdragon Automotive, Mobile and Wear. Description: a secure application running in a non-secure space can restart TrustZon...

CVE-2017-18295

CVE-2017-18295 describes a possible buffer overflow in the DSP Service module across Snapdragon platforms (Automobile, Mobile, Wear) for various Qualcomm SoCs (MDM9206/9607/9650, MSM8909W/8996AU, SD family up to SD835/SDX20). Root cause: input that is not null terminated may overflow a buffer, po...

CVE-2017-18296

Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD...

CVE-2017-18282

Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660...

CVE-2017-18295

Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDX20...