In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in widevine_dash_cmd_handler(), rsp buffers are passed off to widevine commands. These rsp buffers have values in them, such as buffer lengths, that need to be validated to ensure that no buffer overflow/over-reads happen. However, rsp buffers are not always in locked memory, meaning a time-of-check, time-of-use issue can occur where we check that the value is valid, but then a race condition occurs where this memory is swapped out with a different, possibly out of range, value.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| qualcomm | mdm9206_firmware | - | - |
| qualcomm | mdm9607_firmware | - |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
22
Affected Products
4
References
qualcomm / mdm9206_firmware
| - |
| qualcomm | ipq4019_firmware | - | - |
| qualcomm | mdm9625_firmware | - | - |
| qualcomm | mdm9635m_firmware | - | - |
| qualcomm | msm8909w_firmware | - | - |
| qualcomm | sd_210_firmware | - | - |
| qualcomm | sd_212_firmware | - | - |
| qualcomm | sd_205_firmware | - | - |
| qualcomm | sd_400_firmware | - | - |
| qualcomm | sd_410_firmware | - | - |
| qualcomm | sd_412_firmware | - | - |
| qualcomm | sd_600_firmware | - | - |
| qualcomm | sd_615_firmware | - | - |
| qualcomm | sd_616_firmware | - | - |
| qualcomm | sd_415_firmware | - | - |
| qualcomm | sd_617_firmware | - | - |
| qualcomm | sd_650_firmware | - | - |
| qualcomm | sd_652_firmware | - | - |
| qualcomm | sd_800_firmware | - | - |
| qualcomm | sd_808_firmware | - | - |
| qualcomm | sd_810_firmware | - | - |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability
Impact