CVE-2017-18277 — MEDIUM (5.5)

Vulnerability Description

When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835.

CVSS Score

5.5

MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qualcomm	Mdm9206 Firmware	-
Qualcomm	Mdm9206	-
Qualcomm	Mdm9607 Firmware	-
Qualcomm	Mdm9607	-
Qualcomm	Mdm9640 Firmware	-
Qualcomm	Mdm9640	-
Qualcomm	Mdm9650 Firmware	-
Qualcomm	Mdm9650	-
Qualcomm	Msm8909W Firmware	-
Qualcomm	Msm8909W	-
Qualcomm	Qcn5502 Firmware	-
Qualcomm	Qcn5502	-
Qualcomm	Sd 210 Firmware	-
Qualcomm	Sd 210	-
Qualcomm	Sd 212 Firmware	-
Qualcomm	Sd 212	-
Qualcomm	Sd 205 Firmware	-
Qualcomm	Sd 205	-
Qualcomm	Sd 425 Firmware	-
Qualcomm	Sd 425	-

Related Weaknesses (CWE)

CWE-835

References

https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-cThird Party Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-cThird Party Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

FAQ

What is CVE-2017-18277?

CVE-2017-18277 is a vulnerability with a CVSS score of 5.5 (MEDIUM). When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Snapdragon Automobile, Snapdragon Mobile, S...

How severe is CVE-2017-18277?

CVE-2017-18277 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-18277?

Check the references section above for vendor advisories and patch information. Affected products include: Qualcomm Mdm9206 Firmware, Qualcomm Mdm9206, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9607, Qualcomm Mdm9640 Firmware.