CVE-2017-13218

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Access to CNTVCT_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks and this could lead to local information disclosure with no additional execution privileges needed in FSM9055, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA4531, QCA9980, QCN5502, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/102390Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040106Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-01-01Vendor Advisory
https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/102390Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040106Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-01-01Vendor Advisory
https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin

Timeline

Published: Jan 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-132197.5A denial of service vulnerability in the Upstream kernel synaptics touchscreen controller. Product: Android. Versions: Android kernel. Andro CVE-2017-13228.2IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp CVE-2017-132207.8An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053.CVE-2017-132217.8An elevation of privilege vulnerability in the Upstream kernel wifi driver. Product: Android. Versions: Android kernel. Android ID: A-647099 CVE-2017-132227.5An information disclosure vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-38159576.CVE-2017-132257.8In libMtkOmxVdec.so there is a possible heap buffer overflow. This could lead to a remote elevation of privilege enabling code execution as CVE-2017-132267.8An elevation of privilege vulnerability in the MediaTek mtk. Product: Android. Versions: Android kernel. Android ID: A-32591194. References:CVE-2017-132275.5In the autofill service, the package name that is provided by the app process is trusted inappropriately. This could lead to information di CVE-2017-132288.8In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. Thi CVE-2017-132299.8A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-6 CVE-2017-132308.8In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead CVE-2017-132317.8In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no a