CVE-2017-18282

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Mobile, Snapdragon Wear	MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660

References

http://www.securitytracker.com/id/1041432Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-componentsThird Party Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
http://www.securitytracker.com/id/1041432Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-componentsThird Party Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

Timeline

Published: Oct 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-182836.5Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212 CVE-2017-182847.1The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local u CVE-2017-182857.1The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to CVE-2017-182865.4nZEDb v0.7.3.3 has XSS in the 404 error page.CVE-2017-182879.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search parameter.CVE-2017-182889.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter.CVE-2017-182899.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter.CVE-2017-182909.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sort_direction parameter.CVE-2017-182919.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter.CVE-2017-182925.5Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile and CVE-2017-182937.8When a particular GPIO is protected by blocking access to the corresponding GPIO resource registers, the protection can be bypassed using th CVE-2017-182947.8While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size