Sign-up

ID

VAR-201809-0066


CVE

CVE-2017-18280


TITLE

plural Snapdragon Access control vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-014290

DESCRIPTION

In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has opened the SPI/I2C interface to a particular device, it is possible for another Trusted Application to read the data on this open interface by calling the SPI/I2C read function. Snapdragon (Automobile , Mobile , Wear) Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9607, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) for different platforms. An access control error vulnerability exists in Buses in several Qualcomm Snapdragon products. When a trusted application opens the SPI/I2C interface to the device, a local attacker can use other trusted applications to exploit this vulnerability to read data on this open interface

Trust: 1.8

sources: NVD: CVE-2017-18280 // JVNDB: JVNDB-2017-014290 // VULHUB: VHN-109387 // VULMON: CVE-2017-18280

AFFECTED PRODUCTS

vendor:qualcommmodel:sdm439scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd650scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd625scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sdm632scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd820ascope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd652scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd617scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sdm429scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd820scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd835scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:msm8996auscope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd435scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9607scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd205scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd427scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:msm8909wscope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd210scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd450scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd425scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd212scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd430scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9607scope: - version: -

Trust: 0.8

vendor:qualcommmodel:msm8909wscope: - version: -

Trust: 0.8

vendor:qualcommmodel:msm8996auscope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 205scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 210scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 212scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 425scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 427scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 430scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 435scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 450scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 617scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 625scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 650scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 652scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 820scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 820ascope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 835scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm 429scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm 439scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm 632scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-014290 // CNNVD: CNNVD-201809-975 // NVD: CVE-2017-18280

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-18280
value: HIGH

Trust: 1.0

NVD: CVE-2017-18280
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201809-975
value: HIGH

Trust: 0.6

VULHUB: VHN-109387
value: HIGH

Trust: 0.1

VULMON: CVE-2017-18280
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-18280
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-109387
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-18280
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-109387 // VULMON: CVE-2017-18280 // JVNDB: JVNDB-2017-014290 // CNNVD: CNNVD-201809-975 // NVD: CVE-2017-18280

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 0.9

sources: VULHUB: VHN-109387 // JVNDB: JVNDB-2017-014290 // NVD: CVE-2017-18280

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201809-975

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201809-975

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014290

PATCH
title:Android のセキュリティに関する公開情報 - 2018 年 8 月url:https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components
Trust: 0.8
title:September 2018 Qualcomm Technologies, Inc. Security Bulletinurl:https://www.qualcomm.com/company/product-security/bulletins
Trust: 0.8
title:Multiple Qualcomm Snapdragon Product access control error vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85088
Trust: 0.6
title:Android Security Bulletins: Android Security Bulletin—August 2018url:https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=746dc14fcd3f5e139648cfdc9d9039a9
Trust: 0.1
title:SamsungReleaseNotesurl:https://github.com/samreleasenotes/SamsungReleaseNotes 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-18280 // 
            
            
            
            JVNDB: JVNDB-2017-014290 // 
            
            
            
            CNNVD: CNNVD-201809-975

EXTERNAL IDS
db:NVDid:CVE-2017-18280
Trust: 2.6
db:SECTRACKid:1041432
Trust: 1.8
db:JVNDBid:JVNDB-2017-014290
Trust: 0.8
db:CNNVDid:CNNVD-201809-975
Trust: 0.7
db:VULHUBid:VHN-109387
Trust: 0.1
db:VULMONid:CVE-2017-18280
Trust: 0.1
sources:
            
            
            VULHUB: VHN-109387 // 
            
            
            
            VULMON: CVE-2017-18280 // 
            
            
            
            JVNDB: JVNDB-2017-014290 // 
            
            
            
            CNNVD: CNNVD-201809-975 // 
            
            
            
            NVD: CVE-2017-18280

REFERENCES
url:https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components
Trust: 1.8
url:https://www.qualcomm.com/company/product-security/bulletins
Trust: 1.8
url:http://www.securitytracker.com/id/1041432
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18280
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-18280
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://source.android.com/security/bulletin/2018-08-01.html
Trust: 0.1
url:https://github.com/samreleasenotes/samsungreleasenotes
Trust: 0.1
sources:
            
            
            VULHUB: VHN-109387 // 
            
            
            
            VULMON: CVE-2017-18280 // 
            
            
            
            JVNDB: JVNDB-2017-014290 // 
            
            
            
            CNNVD: CNNVD-201809-975 // 
            
            
            
            NVD: CVE-2017-18280

SOURCES
db:VULHUBid:VHN-109387
db:VULMONid:CVE-2017-18280
db:JVNDBid:JVNDB-2017-014290
db:CNNVDid:CNNVD-201809-975
db:NVDid:CVE-2017-18280

LAST UPDATE DATE
2024-11-23T19:52:18.636000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-109387date:2019-10-03T00:00:00
db:VULMONid:CVE-2017-18280date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2017-014290date:2018-12-25T00:00:00
db:CNNVDid:CNNVD-201809-975date:2019-10-23T00:00:00
db:NVDid:CVE-2017-18280date:2024-11-21T03:19:45.513

SOURCES RELEASE DATE
db:VULHUBid:VHN-109387date:2018-09-20T00:00:00
db:VULMONid:CVE-2017-18280date:2018-09-20T00:00:00
db:JVNDBid:JVNDB-2017-014290date:2018-12-25T00:00:00
db:CNNVDid:CNNVD-201809-975date:2018-09-21T00:00:00
db:NVDid:CVE-2017-18280date:2018-09-20T13:29:00.247