In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, when an RSA encryption operation is called, the ce_util_to_unsigned_bin is invoked to convert the input buffer to unsigned binary. The ce_util_to_unsigned_bin function, instead of operating on the size of the unsigned character buffer that is passed, operates on the address - i.e. operates on "c" instead of "*c". Decrementing the address to check if it is less than zero means that the operation will always pass, since a pointer will never be less than zero, and may result in a buffer overflow.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| qualcomm | mdm9206_firmware | - | - |
| qualcomm | mdm9607_firmware | - |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
37
Affected Products
4
References
qualcomm / mdm9206_firmware
| - |
| qualcomm | fsm9055_firmware | - | - |
| qualcomm | mdm9625_firmware | - | - |
| qualcomm | mdm9635m_firmware | - | - |
| qualcomm | mdm9640_firmware | - | - |
| qualcomm | mdm9645_firmware | - | - |
| qualcomm | mdm9650_firmware | - | - |
| qualcomm | mdm9655_firmware | - | - |
| qualcomm | msm8909w_firmware | - | - |
| qualcomm | sd_210_firmware | - | - |
| qualcomm | sd_212_firmware | - | - |
| qualcomm | sd_205_firmware | - | - |
| qualcomm | sd_400_firmware | - | - |
| qualcomm | sd_410_firmware | - | - |
| qualcomm | sd_412_firmware | - | - |
| qualcomm | sd_425_firmware | - | - |
| qualcomm | sd_430_firmware | - | - |
| qualcomm | sd_450_firmware | - | - |
| qualcomm | sd_615_firmware | - | - |
| qualcomm | sd_616_firmware | - | - |
| qualcomm | sd_415_firmware | - | - |
| qualcomm | sd_617_firmware | - | - |
| qualcomm | sd_625_firmware | - | - |
| qualcomm | sd_650_firmware | - | - |
| qualcomm | sd_652_firmware | - | - |
| qualcomm | sd_800_firmware | - | - |
| qualcomm | sd_808_firmware | - | - |
| qualcomm | sd_810_firmware | - | - |
| qualcomm | sd_820_firmware | - | - |
| qualcomm | sd_835_firmware | - | - |
| qualcomm | sd_845_firmware | - | - |
| qualcomm | sdx20_firmware | - | - |
| qualcomm | sd_850_firmware | - | - |
| qualcomm | ipq4019_firmware | - | - |
| qualcomm | sd_600_firmware | - | - |
| qualcomm | sd_820a_firmware | - | - |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability
Impact