CVE-2017-18302

Severity Score

4.7

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, a crafted HLOS client can modify the structure in memory passed to a QSEE application between the time of check and the time of use, resulting in arbitrary writes to TZ kernel memory regions.

En Snapdragon (Automobile y Mobile) en versiones MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660 y Snapdragon_High_Med_2016, un cliente HLOS manipulado puede modificar la estructura en la memoria pasada a una aplicación QSEE entre el momento de la comprobación y el momento del uso, lo que desemboca en escrituras arbitrarias a las regiones de memoria del kernel TZ.

*Credits: N/A

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Complete

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-06-15 CVE Reserved
2018-09-20 CVE Published
2023-09-14 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CAPEC

References (3)

URL	Tag	Source
http://www.securitytracker.com/id/1041432	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components	2018-11-23
https://www.qualcomm.com/company/product-security/bulletins	2018-11-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Qualcomm Search vendor "Qualcomm"	Msm8996au Firmware Search vendor "Qualcomm" for product "Msm8996au Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Msm8996au Search vendor "Qualcomm" for product "Msm8996au"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd425 Firmware Search vendor "Qualcomm" for product "Sd425 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd425 Search vendor "Qualcomm" for product "Sd425"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd427 Firmware Search vendor "Qualcomm" for product "Sd427 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd427 Search vendor "Qualcomm" for product "Sd427"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd430 Firmware Search vendor "Qualcomm" for product "Sd430 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd430 Search vendor "Qualcomm" for product "Sd430"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd435 Firmware Search vendor "Qualcomm" for product "Sd435 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd435 Search vendor "Qualcomm" for product "Sd435"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd450 Firmware Search vendor "Qualcomm" for product "Sd450 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd450 Search vendor "Qualcomm" for product "Sd450"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd625 Firmware Search vendor "Qualcomm" for product "Sd625 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd625 Search vendor "Qualcomm" for product "Sd625"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd650 Firmware Search vendor "Qualcomm" for product "Sd650 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd650 Search vendor "Qualcomm" for product "Sd650"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd652 Firmware Search vendor "Qualcomm" for product "Sd652 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd652 Search vendor "Qualcomm" for product "Sd652"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd820 Firmware Search vendor "Qualcomm" for product "Sd820 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd820 Search vendor "Qualcomm" for product "Sd820"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd820a Firmware Search vendor "Qualcomm" for product "Sd820a Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd820a Search vendor "Qualcomm" for product "Sd820a"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sd835 Firmware Search vendor "Qualcomm" for product "Sd835 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sd835 Search vendor "Qualcomm" for product "Sd835"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sda660 Firmware Search vendor "Qualcomm" for product "Sda660 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sda660 Search vendor "Qualcomm" for product "Sda660"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm429 Firmware Search vendor "Qualcomm" for product "Sdm429 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm429 Search vendor "Qualcomm" for product "Sdm429"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm439 Firmware Search vendor "Qualcomm" for product "Sdm439 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm439 Search vendor "Qualcomm" for product "Sdm439"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm630 Firmware Search vendor "Qualcomm" for product "Sdm630 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm630 Search vendor "Qualcomm" for product "Sdm630"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm632 Firmware Search vendor "Qualcomm" for product "Sdm632 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm632 Search vendor "Qualcomm" for product "Sdm632"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm636 Firmware Search vendor "Qualcomm" for product "Sdm636 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm636 Search vendor "Qualcomm" for product "Sdm636"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm660 Firmware Search vendor "Qualcomm" for product "Sdm660 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm660 Search vendor "Qualcomm" for product "Sdm660"	-	-	Safe