Data Abort Vulnerability in Qualcomm Snapdragon Automotive and Mobile Products
CVE-2017-18320

7.8HIGH

Key Information:

Vendor

Qualcomm
Status
Snapdragon Automobile, Snapdragon Mobile
Vendor
CVE Published:
3 January 2019

What is CVE-2017-18320?

This vulnerability arises from an improper unload attempt of a third-party Trusted Execution Environment (TEE) by the Qualcomm Secure Execution Environment (QSEE). It results in a critical data abort issue across multiple Snapdragon Automotive and Mobile platforms, potentially allowing unauthorized access and execution errors that could compromise device integrity and security.

Affected Version(s)

Snapdragon Automobile, Snapdragon Mobile MSM8996AU, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130

References

https://www.qualcomm.com/company/product-security/bulletins
x_refsource_CONFIRM
http://www.securityfocus.com/bid/106128
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-18320 : Data Abort Vulnerability in Qualcomm Snapdragon Automotive and Mobile Products