CVE-2018-13909 — HIGH (7.0)

Vulnerability Description

Metadata verification and partial hash system calls by bootloader may corrupt parallel hashing state in progress resulting in unexpected behavior in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, Qualcomm 215, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130

CVSS Score

7.0

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qualcomm	Mdm9206 Firmware	-
Qualcomm	Mdm9206	-
Qualcomm	Mdm9607 Firmware	-
Qualcomm	Mdm9607	-
Qualcomm	Mdm9650 Firmware	-
Qualcomm	Mdm9650	-
Qualcomm	Mdm9655 Firmware	-
Qualcomm	Mdm9655	-
Qualcomm	Qcs605 Firmware	-
Qualcomm	Qcs605	-
Qualcomm	Qm215 Firmware	-
Qualcomm	Qm215	-
Qualcomm	Sd 410 Firmware	-
Qualcomm	Sd 410	-
Qualcomm	Sd 412 Firmware	-
Qualcomm	Sd 412	-
Qualcomm	Sd 425 Firmware	-
Qualcomm	Sd 425	-
Qualcomm	Sd 427 Firmware	-
Qualcomm	Sd 427	-

Related Weaknesses (CWE)

CWE-362

References

https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

FAQ

What is CVE-2018-13909?

CVE-2018-13909 is a vulnerability with a CVSS score of 7.0 (HIGH). Metadata verification and partial hash system calls by bootloader may corrupt parallel hashing state in progress resulting in unexpected behavior in Snapdragon Auto, Snapdragon Compute, Snapdragon Con...

How severe is CVE-2018-13909?

CVE-2018-13909 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-13909?

Check the references section above for vendor advisories and patch information. Affected products include: Qualcomm Mdm9206 Firmware, Qualcomm Mdm9206, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9607, Qualcomm Mdm9650 Firmware.