CVE-2018-5837

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, MAC address randomization performed during probe requests is not done properly due to a flawed RNG which produced repeating output much earlier than expected.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-338

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear	IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016

References

https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-componentsVendor Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-componentsVendor Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

Timeline

Published: Sep 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-58387.8Improper Validation of Array Index In the adreno OpenGL driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, an out-of-bo CVE-2018-58397.1Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Sna CVE-2018-58407.8Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android releases from CAF (And CVE-2018-58417.8dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lea CVE-2018-58427.8An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (An CVE-2018-58437.8In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using th CVE-2018-58447.8In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all Android releases fro CVE-2018-58457.0A race condition in drm_atomic_nonblocking_commit() in the display driver can potentially lead to a Use After Free scenario in all Android r CVE-2018-58467.8A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD/IPA_IOC_NOTIFY_WAN_UPST CVE-2018-58477.8Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF (Android for MSM, Fi CVE-2018-58487.8In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of t CVE-2018-58497.0Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the