Details of VAR-201807-1352

ID

VAR-201807-1352

CVE

CVE-2018-11257

TITLE

Snapdragon Mobile Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-007955

DESCRIPTION

Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versions SD 210/SD 212/SD 205, SD 845, SD 850. Snapdragon Mobile Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm SD210 and other Qualcomm's central processing unit (CPU) products for mobile devices. There are privilege escalation vulnerabilities in several Qualcomm products. An attacker could exploit this vulnerability to clean up RPMB. Qualcomm Closed-Source Components are prone to multiple unspecified vulnerabilities. This may aid in further attacks. These issues are being tracked by Android Bug IDs A-78240792, A-78240715, A-78240449, A-78240612, A-78240794, A-78240199, A-78240071, A-78240736, A-78242049, A-78241971, A-78241834, A-78241375, A-68989823, A-72951265, A-74235874, A-74236406, A-77485022, A-77485183, A-77485139, A-77483830, and A-77484449. The following products (for mobile devices) are affected: Qualcomm SD 210; SD 212; SD 205; SD 845; SD 850

Trust: 2.61

sources: NVD: CVE-2018-11257 // JVNDB: JVNDB-2018-007955 // CNVD: CNVD-2018-12823 // BID: 104760 // VULHUB: VHN-121098 // VULMON: CVE-2018-11257

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-12823

AFFECTED PRODUCTS

vendor:	qualcomm	model:	sd 205	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 210	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 212	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 845	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 850	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 205	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 210	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 212	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 845	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 850	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd	scope:	eq	version:	210	Trust: 0.6
vendor:	qualcomm	model:	sd	scope:	eq	version:	212	Trust: 0.6
vendor:	qualcomm	model:	sd	scope:	eq	version:	205	Trust: 0.6
vendor:	qualcomm	model:	sd	scope:	eq	version:	845	Trust: 0.6
vendor:	qualcomm	model:	sd	scope:	eq	version:	850	Trust: 0.6
vendor:	google	model:	pixel xl	scope:	eq	version:	0	Trust: 0.3
vendor:	google	model:	pixel c	scope:	eq	version:	0	Trust: 0.3
vendor:	google	model:	pixel	scope:	eq	version:	0	Trust: 0.3
vendor:	google	model:	nexus player	scope:	eq	version:	0	Trust: 0.3
vendor:	google	model:	nexus	scope:	eq	version:	9	Trust: 0.3
vendor:	google	model:	nexus 6p	scope:	-	version:	-	Trust: 0.3
vendor:	google	model:	nexus	scope:	eq	version:	6	Trust: 0.3
vendor:	google	model:	nexus	scope:	eq	version:	5x	Trust: 0.3
vendor:	google	model:	android	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2018-12823 // BID: 104760 // JVNDB: JVNDB-2018-007955 // CNNVD: CNNVD-201807-426 // NVD: CVE-2018-11257

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-11257
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-11257
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-12823
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201807-426
value:	HIGH
Trust: 0.6
VULHUB:	VHN-121098
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2018-11257
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-11257
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2018-12823
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-121098
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-11257
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-12823 // VULHUB: VHN-121098 // VULMON: CVE-2018-11257 // JVNDB: JVNDB-2018-007955 // CNNVD: CNNVD-201807-426 // NVD: CVE-2018-11257

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-264	Trust: 0.9

sources: VULHUB: VHN-121098 // JVNDB: JVNDB-2018-007955 // NVD: CVE-2018-11257

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201807-426

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201807-426

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-007955

PATCH

title:	July 2018 Qualcomm Technologies, Inc. Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins	Trust: 0.8
title:	Patches for multiple Qualcomm product privilege escalation vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/133989	Trust: 0.6
title:	Multiple Qualcomm Product Privilege License and Access Control Vulnerability Fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=81847	Trust: 0.6
title:	Android Security Bulletins: Android Security Bulletin—July 2018	url:	https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=25584b3d319ca9e7cb2fae9ec5dbf5e0	Trust: 0.1
title:	SamsungReleaseNotes	url:	https://github.com/samreleasenotes/SamsungReleaseNotes	Trust: 0.1

sources: CNVD: CNVD-2018-12823 // VULMON: CVE-2018-11257 // JVNDB: JVNDB-2018-007955 // CNNVD: CNNVD-201807-426

EXTERNAL IDS

db:	NVD	id:	CVE-2018-11257	Trust: 3.5
db:	JVNDB	id:	JVNDB-2018-007955	Trust: 0.8
db:	CNNVD	id:	CNNVD-201807-426	Trust: 0.7
db:	CNVD	id:	CNVD-2018-12823	Trust: 0.6
db:	BID	id:	104760	Trust: 0.3
db:	VULHUB	id:	VHN-121098	Trust: 0.1
db:	VULMON	id:	CVE-2018-11257	Trust: 0.1

sources: CNVD: CNVD-2018-12823 // VULHUB: VHN-121098 // VULMON: CVE-2018-11257 // BID: 104760 // JVNDB: JVNDB-2018-007955 // CNNVD: CNNVD-201807-426 // NVD: CVE-2018-11257

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins	Trust: 2.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-11257	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-11257	Trust: 0.8
url:	http://code.google.com/android/	Trust: 0.3
url:	http://www.qualcomm.com/	Trust: 0.3
url:	https://source.android.com/security/bulletin/2018-07-01	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://source.android.com/security/bulletin/2018-07-01.html	Trust: 0.1
url:	https://github.com/samreleasenotes/samsungreleasenotes	Trust: 0.1

sources: CNVD: CNVD-2018-12823 // VULHUB: VHN-121098 // VULMON: CVE-2018-11257 // BID: 104760 // JVNDB: JVNDB-2018-007955 // CNNVD: CNNVD-201807-426 // NVD: CVE-2018-11257

CREDITS

The vendor reported these issues.

Trust: 0.3

sources: BID: 104760

SOURCES

db:	CNVD	id:	CNVD-2018-12823
db:	VULHUB	id:	VHN-121098
db:	VULMON	id:	CVE-2018-11257
db:	BID	id:	104760
db:	JVNDB	id:	JVNDB-2018-007955
db:	CNNVD	id:	CNNVD-201807-426
db:	NVD	id:	CVE-2018-11257

LAST UPDATE DATE

2024-08-14T14:04:28.202000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-12823	date:	2018-07-10T00:00:00
db:	VULHUB	id:	VHN-121098	date:	2019-10-03T00:00:00
db:	VULMON	id:	CVE-2018-11257	date:	2019-10-03T00:00:00
db:	BID	id:	104760	date:	2018-07-02T00:00:00
db:	JVNDB	id:	JVNDB-2018-007955	date:	2018-10-03T00:00:00
db:	CNNVD	id:	CNNVD-201807-426	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2018-11257	date:	2019-10-03T00:03:26.223

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-12823	date:	2018-07-10T00:00:00
db:	VULHUB	id:	VHN-121098	date:	2018-07-06T00:00:00
db:	VULMON	id:	CVE-2018-11257	date:	2018-07-06T00:00:00
db:	BID	id:	104760	date:	2018-07-02T00:00:00
db:	JVNDB	id:	JVNDB-2018-007955	date:	2018-10-03T00:00:00
db:	CNNVD	id:	CNNVD-201807-426	date:	2018-07-09T00:00:00
db:	NVD	id:	CVE-2018-11257	date:	2018-07-06T17:29:00.647