ByteOS

Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

Product

Versions

Affected

MDM9206, MDM9625, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, SD 820A

Problem Types

Type	CWE ID	Description
text	N/A	Time-of-check Time-of-use (TOCTOU) Race Condition in TrustZone

Type: text

CWE ID: N/A

Description: Time-of-check Time-of-use (TOCTOU) Race Condition in TrustZone

References

Hyperlink	Resource
https://source.android.com/security/bulletin/2018-04-01	x_refsource_CONFIRM
http://www.securityfocus.com/bid/103671	vdb-entry x_refsource_BID

Hyperlink: https://source.android.com/security/bulletin/2018-04-01

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/103671

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://source.android.com/security/bulletin/2018-04-01	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/103671	vdb-entry x_refsource_BID x_transferred

Hyperlink: https://source.android.com/security/bulletin/2018-04-01

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/103671

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@qualcomm.com

Published At:18 Apr, 2018 | 14:29

Updated At:01 May, 2018 | 17:38

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.0

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*

>>mdm9206_firmware>>-

cpe:2.3:h:qualcomm:mdm9206:-:*:*:*:*:*:*:*

>>mdm9206>>-

cpe:2.3:o:qualcomm:mdm9625_firmware:-:*:*:*:*:*:*:*

>>mdm9625_firmware>>-

cpe:2.3:h:qualcomm:mdm9625:-:*:*:*:*:*:*:*

>>mdm9625>>-

cpe:2.3:o:qualcomm:mdm9635m_firmware:-:*:*:*:*:*:*:*

>>mdm9635m_firmware>>-

cpe:2.3:h:qualcomm:mdm9635m:-:*:*:*:*:*:*:*

>>mdm9635m>>-

cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*

>>mdm9640_firmware>>-

cpe:2.3:h:qualcomm:mdm9640:-:*:*:*:*:*:*:*

>>mdm9640>>-

cpe:2.3:o:qualcomm:mdm9645_firmware:-:*:*:*:*:*:*:*

>>mdm9645_firmware>>-

cpe:2.3:h:qualcomm:mdm9645:-:*:*:*:*:*:*:*

>>mdm9645>>-

cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*

>>msm8909w_firmware>>-

cpe:2.3:h:qualcomm:msm8909w:-:*:*:*:*:*:*:*

>>msm8909w>>-

cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*

>>sd_210_firmware>>-

cpe:2.3:h:qualcomm:sd_210:-:*:*:*:*:*:*:*

>>sd_210>>-

cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*

>>sd_212_firmware>>-

cpe:2.3:h:qualcomm:sd_212:-:*:*:*:*:*:*:*

>>sd_212>>-

cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*

>>sd_205_firmware>>-

cpe:2.3:h:qualcomm:sd_205:-:*:*:*:*:*:*:*

>>sd_205>>-

cpe:2.3:o:qualcomm:sd_400_firmware:-:*:*:*:*:*:*:*

>>sd_400_firmware>>-

cpe:2.3:h:qualcomm:sd_400:-:*:*:*:*:*:*:*

>>sd_400>>-

cpe:2.3:o:qualcomm:sd_410_firmware:-:*:*:*:*:*:*:*

>>sd_410_firmware>>-

cpe:2.3:h:qualcomm:sd_410:-:*:*:*:*:*:*:*

>>sd_410>>-

cpe:2.3:o:qualcomm:sd_412_firmware:-:*:*:*:*:*:*:*

>>sd_412_firmware>>-

cpe:2.3:h:qualcomm:sd_412:-:*:*:*:*:*:*:*

>>sd_412>>-

cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*

>>sd_425_firmware>>-

cpe:2.3:h:qualcomm:sd_425:-:*:*:*:*:*:*:*

>>sd_425>>-

cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*

>>sd_430_firmware>>-

cpe:2.3:h:qualcomm:sd_430:-:*:*:*:*:*:*:*

>>sd_430>>-

cpe:2.3:o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*

>>sd_450_firmware>>-

cpe:2.3:h:qualcomm:sd_450:-:*:*:*:*:*:*:*

>>sd_450>>-

cpe:2.3:o:qualcomm:sd_615_firmware:-:*:*:*:*:*:*:*

>>sd_615_firmware>>-

cpe:2.3:h:qualcomm:sd_615:-:*:*:*:*:*:*:*

>>sd_615>>-

cpe:2.3:o:qualcomm:sd_616_firmware:-:*:*:*:*:*:*:*

>>sd_616_firmware>>-

cpe:2.3:h:qualcomm:sd_616:-:*:*:*:*:*:*:*

>>sd_616>>-

cpe:2.3:o:qualcomm:sd_415_firmware:-:*:*:*:*:*:*:*

>>sd_415_firmware>>-

cpe:2.3:h:qualcomm:sd_415:-:*:*:*:*:*:*:*

>>sd_415>>-

cpe:2.3:o:qualcomm:sd_617_firmware:-:*:*:*:*:*:*:*

>>sd_617_firmware>>-

cpe:2.3:h:qualcomm:sd_617:-:*:*:*:*:*:*:*

>>sd_617>>-

cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*

>>sd_625_firmware>>-

cpe:2.3:h:qualcomm:sd_625:-:*:*:*:*:*:*:*

>>sd_625>>-

cpe:2.3:o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:*

>>sd_650_firmware>>-

cpe:2.3:h:qualcomm:sd_650:-:*:*:*:*:*:*:*

>>sd_650>>-

cpe:2.3:o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:*

>>sd_652_firmware>>-

cpe:2.3:h:qualcomm:sd_652:-:*:*:*:*:*:*:*

>>sd_652>>-

cpe:2.3:o:qualcomm:sd_800_firmware:-:*:*:*:*:*:*:*

>>sd_800_firmware>>-

cpe:2.3:h:qualcomm:sd_800:-:*:*:*:*:*:*:*

>>sd_800>>-

cpe:2.3:o:qualcomm:sd_808_firmware:-:*:*:*:*:*:*:*

>>sd_808_firmware>>-

cpe:2.3:h:qualcomm:sd_808:-:*:*:*:*:*:*:*

>>sd_808>>-

cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*

>>sd_820_firmware>>-

cpe:2.3:h:qualcomm:sd_820:-:*:*:*:*:*:*:*

>>sd_820>>-

Weaknesses

CWE ID	Type	Source
CWE-362	Primary	nvd@nist.gov

CWE ID: CWE-362

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/103671	product-security@qualcomm.com	Third Party Advisory VDB Entry
https://source.android.com/security/bulletin/2018-04-01	product-security@qualcomm.com	Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/103671

Source: product-security@qualcomm.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://source.android.com/security/bulletin/2018-04-01

Source: product-security@qualcomm.com

Resource:

Vendor Advisory

Similar CVEs

0Records found

CVE-2016-10439

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.14% / 35.28%

7 Day CHG~0.00%

Published-18 Apr, 2018 | 14:00

Updated-16 Sep, 2024 | 23:46

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, there is a TOCTOU vulnerability in the input validation for bulletin_board_read syscall. A pointer dereference is being validated without promising the pointer hasn't been changed by the HLOS program.

Product-sd_652 sd_425_firmware sd_820a sd_625_firmware sd_450 sd_425 sd_430_firmware sd_430 sd_625 sd_820_firmware sd_820 sd_650 sd_450_firmware sd_652_firmware sd_820a_firmware sd_650_firmware Snapdragon Automobile, Snapdragon Mobile

CWE ID-CWE-476

NULL Pointer Dereference

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2016-10432

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.17% / 38.41%

7 Day CHG~0.00%

Published-18 Apr, 2018 | 14:00

Updated-16 Sep, 2024 | 20:59

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 820, and SD 820A, TOCTOU vulnerabilities may occur while sanitizing userspace values passed to tQSEE system call.

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2016-10297

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7||HIGH

EPSS-0.03% / 5.82%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2016-10383

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.12% / 31.30%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-20 Apr, 2025 | 01:37

In all Qualcomm products with Android releases from CAF using the Linux kernel, there is a TOCTOU race condition in Secure UI.

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2016-10409

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.17% / 38.41%

7 Day CHG~0.00%

Published-18 Apr, 2018 | 14:00

Updated-16 Sep, 2024 | 22:09

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, and SD 835, TOCTOU vulnerability may occur while composing the RPMB request using HLOS controlled buffers.

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2018-13903

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.22% / 44.52%

7 Day CHG~0.00%

Published-08 Sep, 2020 | 09:31

Updated-05 Aug, 2024 | 09:14

u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9205, MDM9206, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, SDM450, SM8150

CWE ID-CWE-476

NULL Pointer Dereference

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2017-9685

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.12% / 31.30%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 19:00

Updated-20 Apr, 2025 | 01:37

In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in a WLAN driver can lead to a Use After Free condition.

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE ID-CWE-416

Use After Free

CVE-2016-10433

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.17% / 38.41%

7 Day CHG~0.00%

Published-18 Apr, 2018 | 14:00

Updated-16 Sep, 2024 | 19:56

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, TOCTOU vulnerability during SSD image decryption may cause memory corruption.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2016-10417

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.15% / 35.95%

7 Day CHG~0.00%

Published-18 Apr, 2018 | 14:00

Updated-17 Sep, 2024 | 01:16

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SDX20, in QTEE, a TOCTOU vulnerability exists due to improper access control.

CWE ID-CWE-284

Improper Access Control

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2019-10529

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-9.06% / 92.30%

7 Day CHG~0.00%

Published-06 Nov, 2019 | 17:11

Updated-04 Aug, 2024 | 22:24

Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24

Product-sd_850 mdm9150_firmware sd_632 mdm9640_firmware sd_820a sd_675 msm8996au_firmware sd_439 sd_670_firmware sd_429 sdx24 sdm439 mdm9650 sd_636 sd_615_firmware msm8909w_firmware msm8996au sd_820 sd_450_firmware sd_845_firmware sd_820a_firmware qcs605_firmware sd_675_firmware mdm9206 sd_425_firmware sd_665 sdx24_firmware sd_625_firmware sd_450 sd_845 mdm9206_firmware qcs605 sd_632_firmware sd_835_firmware mdm9650_firmware sd_835 sda660 sd_210_firmware sd_415_firmware msm8909w sd_665_firmware sd_616_firmware sd_205_firmware sd_415 sd_212 sd_712 sd_855 sd_730_firmware qualcomm_215 sdx20 sd_616 sd_425 sdm660 sdm630 mdm9607_firmware sd_615 sd_710_firmware qcs405 sd_625 sd_820_firmware sd_210 mdm9607 sd_636_firmware sd_439_firmware qualcomm_215_firmware mdm9150 sd_429_firmware sd_730 sd_212_firmware sd_850_firmware sd_855_firmware sdm439_firmware qcs405_firmware sd_712_firmware sdm630_firmware sda660_firmware sd_670 sdx20_firmware sd_710 sd_205 sdm660_firmware mdm9640 Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2010-3403

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-2.00% / 82.90%

7 Day CHG~0.00%

Published-16 Sep, 2010 | 19:39

Updated-11 Apr, 2025 | 00:51

Untrusted search path vulnerability in Qualcomm eXtensible Diagnostic Monitor (QXDM) 03.09.19 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .isf file.

Vendor-n/a Qualcomm Technologies, Inc.

Product-extensible_diagnostic_monitor n/a

CVE-2018-5841

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 12.66%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-16 Sep, 2024 | 19:35

dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-1188

Initialization of a Resource with an Insecure Default

CVE-2016-10389

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.09% / 26.03%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-20 Apr, 2025 | 01:37

In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions, so there is a possibility of writing beyond the intended partition.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-10239

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone access control policy may potentially be bypassed in all Android releases from CAF using the Linux kernel due to improper input validation an integer overflow vulnerability leading to a buffer overflow could potentially occur and a buffer over-read vulnerability could potentially occur.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2016-10342

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a syscall handler.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-10338

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, there was an issue related to RPMB processing.

CWE ID-CWE-20

Improper Input Validation

CVE-2018-5846

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 15.16%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-17 Sep, 2024 | 01:06

A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD/IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_DEL/IPA_IOC_NOTIFY_WAN_EMBMS_CONNECTED are called in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-416

Use After Free

CVE-2016-10237

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.05% / 15.48%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF using the Linux kernel, the TA would not detect an issue and it would be treated as secure memory.

CWE ID-CWE-284

Improper Access Control

CVE-2016-10340

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, an integer underflow leading to buffer overflow vulnerability exists in a syscall handler.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-10238

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a page alignment issue.

CVE-2016-10341

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended.

CVE-2015-9003

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel.

CVE-2018-3565

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 13.46%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-17 Sep, 2024 | 04:03

While sending a probe request indication in lim_send_sme_probe_req_ind() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overflow can occur.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3580

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 13.46%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-17 Sep, 2024 | 04:09

Stack-based buffer overflow can occur In the WLAN driver if the pmkid_count value is larger than the PMKIDCache size in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-9007

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.03% / 8.48%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.

CWE ID-CWE-415

Double Free

CVE-2015-9005

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.05%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2015-9006

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.03% / 7.05%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.

CWE ID-CWE-284

Improper Access Control

CVE-2015-9000

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone an untrusted pointer dereference vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-9023

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the PlayReady API.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-9020

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-9033

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer.

CWE ID-CWE-20

Improper Input Validation

CVE-2015-9025

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8998

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2015-9002

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.

CVE-2015-9029

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 15.48%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory.

CWE ID-CWE-284

Improper Access Control

CVE-2015-8995

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2018-5850

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 13.46%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-16 Sep, 2024 | 18:08

In the function csr_update_fils_params_rso(), insufficient validation on a key length can result in an integer underflow leading to a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-191

Integer Underflow (Wrap or Wraparound)

CVE-2015-8999

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-5840

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 12.02%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-16 Sep, 2024 | 21:08

Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2015-9030

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.15% / 35.71%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication.

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2015-9027

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-9026

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 18.15%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-9028

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-13 Jun, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-3578

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.00%

7 Day CHG~0.00%

Published-06 Jun, 2018 | 21:00

Updated-16 Sep, 2024 | 20:52

Type mismatch for ie_len can cause the WLAN driver to allocate less memory on the heap due to implicit casting leading to a heap buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2021-35082

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.17% / 38.25%

7 Day CHG~0.00%

Published-14 Jun, 2022 | 09:50

Updated-04 Aug, 2024 | 00:33

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT

Product-mdm9206 qca9377_firmware qca9367_firmware qca9377 qca9367 mdm9206_firmware Snapdragon Industrial IOT

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CVE-2014-9942

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.04% / 9.44%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.

CWE ID-CWE-665

Improper Initialization

CVE-2021-30347

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.23% / 45.76%

7 Day CHG~0.00%

Published-14 Jun, 2022 | 10:11

Updated-03 Aug, 2024 | 22:32

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Product-wcn3991_firmware wsa8830 sd678 sm6250p_firmware qca8337 wcd9360_firmware sdx65 wcn3950_firmware sd765g_firmware qca6595au_firmware qca6390_firmware sd690_5g sd730_firmware wcd9370 sd_675_firmware sd675_firmware qca6426 wcn3998 wcd9385_firmware sdxr2_5g_firmware wcn3950 sd720g sd_8_gen1_5g_firmware sm6375_firmware sm7315_firmware qca6574au_firmware sdx55_firmware qca6595au qca8081_firmware wcd9375_firmware wcn3998_firmware sm7250p_firmware wcd9360 qca6436_firmware sd778g sa515m_firmware qcs6490 sdxr2_5g wcn3988_firmware sm6250 sd778g_firmware wsa8810_firmware sd765g sd765_firmware qca6436 wcn6851 qca8081 wcd9385 wcd9341 qca6696_firmware qcs6490_firmware sd750g sd870_firmware qca6390 ar8035 sd750g_firmware wcd9375 sm6250_firmware wsa8830_firmware sd865_5g_firmware qcm6490 sd888_5g_firmware wcn3988 wcn6850_firmware wsa8815_firmware wsa8835_firmware qcx315 sm8475 wcn6750_firmware sm6375 wcn3991 qca8337_firmware wcd9380_firmware sd_675 sd780g sd865_5g sdx55m_firmware wcn6856_firmware sd888 wsa8835 qcx315_firmware wcd9380 sd888_5g sm6250p qca6574a sd690_5g_firmware wcn6855_firmware sm7325p wcn3980 wcn6750 sa515m wsa8815 sm7325p_firmware wcn6850 sd765 qca6426_firmware qca6574a_firmware sd768g_firmware wcn3980_firmware sm7315 sd730 qca6391 sdx55m wcn6740_firmware sdx65_firmware sd678_firmware qcm6490_firmware sd480_firmware wcn6851_firmware qca6574au wcd9341_firmware sd480 sd870 wsa8810 wcn6855 wcn6856 sd768g wcn6740 qca6696 qca6391_firmware sd780g_firmware wcd9370_firmware sdx55 sd888_firmware sd675 sm7250p sd720g_firmware ar8035_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CVE-2014-9935

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone an integer overflow vulnerability leading to a buffer overflow could potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2014-9937

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.06% / 19.60%

7 Day CHG~0.00%

Published-16 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In TrustZone a buffer overflow vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2014-9944

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.04% / 10.05%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.