Details of VAR-201810-0063

ID

VAR-201810-0063

CVE

CVE-2017-18299

TITLE

plural Snapdragon Access control vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-014305

DESCRIPTION

Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660. Snapdragon Automobile , Snapdragon Mobile , Snapdragon Wear Contains an access control vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Qualcomm MDM9206, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. An input validation vulnerability exists in the Core of several Qualcomm Snapdragon products due to incorrect form merge conversion logic. An attacker could exploit this vulnerability to cause resource exhaustion and QSEE errors

Trust: 1.8

sources: NVD: CVE-2017-18299 // JVNDB: JVNDB-2017-014305 // VULHUB: VHN-109407 // VULMON: CVE-2017-18299

AFFECTED PRODUCTS

vendor:	qualcomm	model:	sd 205	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 210	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 212	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	msm8996au	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 650	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	mdm9206	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	mdm9650	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 652	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 450	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sda660	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 835	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 425	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 820a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 850	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 820	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 430	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 625	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9206	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9607	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9650	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8996au	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 205	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 210	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 212	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 425	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 430	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 450	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 625	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 650	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 652	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 820	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 820a	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 835	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 845	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 850	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sda 660	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2017-014305 // CNNVD: CNNVD-201810-1160 // NVD: CVE-2017-18299

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-18299
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-18299
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201810-1160
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-109407
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2017-18299
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-18299
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:L/AC:L/AU:N/C:N/I:N/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-109407
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:L/AC:L/AU:N/C:N/I:N/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-18299
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-109407 // VULMON: CVE-2017-18299 // JVNDB: JVNDB-2017-014305 // CNNVD: CNNVD-201810-1160 // NVD: CVE-2017-18299

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.1
problemtype:	CWE-284	Trust: 0.9

sources: VULHUB: VHN-109407 // JVNDB: JVNDB-2017-014305 // NVD: CVE-2017-18299

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201810-1160

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201810-1160

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014305

PATCH

title:	October 2018 Qualcomm Technologies, Inc. Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins	Trust: 0.8
title:	Multiple Qualcomm Snapdragon Fixes for product input validation vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86258	Trust: 0.6
title:	Android Security Bulletins: Android Security Bulletin—August 2018	url:	https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=746dc14fcd3f5e139648cfdc9d9039a9	Trust: 0.1
title:	SamsungReleaseNotes	url:	https://github.com/samreleasenotes/SamsungReleaseNotes	Trust: 0.1

sources: VULMON: CVE-2017-18299 // JVNDB: JVNDB-2017-014305 // CNNVD: CNNVD-201810-1160

EXTERNAL IDS

db:	NVD	id:	CVE-2017-18299	Trust: 2.6
db:	SECTRACK	id:	1041432	Trust: 1.8
db:	JVNDB	id:	JVNDB-2017-014305	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-1160	Trust: 0.7
db:	VULHUB	id:	VHN-109407	Trust: 0.1
db:	VULMON	id:	CVE-2017-18299	Trust: 0.1

sources: VULHUB: VHN-109407 // VULMON: CVE-2017-18299 // JVNDB: JVNDB-2017-014305 // CNNVD: CNNVD-201810-1160 // NVD: CVE-2017-18299

REFERENCES

url:	https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components	Trust: 1.8
url:	https://www.qualcomm.com/company/product-security/bulletins	Trust: 1.8
url:	http://www.securitytracker.com/id/1041432	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18299	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-18299	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/400.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://source.android.com/security/bulletin/2018-08-01.html	Trust: 0.1
url:	https://github.com/samreleasenotes/samsungreleasenotes	Trust: 0.1

sources: VULHUB: VHN-109407 // VULMON: CVE-2017-18299 // JVNDB: JVNDB-2017-014305 // CNNVD: CNNVD-201810-1160 // NVD: CVE-2017-18299

SOURCES

db:	VULHUB	id:	VHN-109407
db:	VULMON	id:	CVE-2017-18299
db:	JVNDB	id:	JVNDB-2017-014305
db:	CNNVD	id:	CNNVD-201810-1160
db:	NVD	id:	CVE-2017-18299

LAST UPDATE DATE

2024-11-23T21:03:47.521000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-109407	date:	2019-10-03T00:00:00
db:	VULMON	id:	CVE-2017-18299	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2017-014305	date:	2019-01-11T00:00:00
db:	CNNVD	id:	CNNVD-201810-1160	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-18299	date:	2024-11-21T03:19:48.303

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-109407	date:	2018-10-23T00:00:00
db:	VULMON	id:	CVE-2017-18299	date:	2018-10-23T00:00:00
db:	JVNDB	id:	JVNDB-2017-014305	date:	2019-01-11T00:00:00
db:	CNNVD	id:	CNNVD-201810-1160	date:	2018-10-24T00:00:00
db:	NVD	id:	CVE-2017-18299	date:	2018-10-23T13:29:02.010