CVE-2018-13912
Arbitrary write issue can occur when user provides kernel address in compat mode in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in…
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
Arbitrary write issue can occur when user provides kernel address in compat mode in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.20% probability · 10th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- qualcomm/snapdragon auto firmware · qualcomm/snapdragon connectivity firmware · qualcomm/snapdragon consumer internet of things firmware · qualcomm/snapdragon industrial internet of things firmware · qualcomm/snapdragon mobile firmware · qualcomm/snapdragon voice \& music firmware · qualcomm/mdm9150 firmware · qualcomm/mdm9206 firmware · qualcomm/mdm9607 firmware · qualcomm/mdm9640 firmware · qualcomm/mdm9650 firmware · qualcomm/msm8909w firmware · qualcomm/msm8996au firmware · qualcomm/qcs605 firmware · qualcomm/sd 210 firmware · qualcomm/sd 212 firmware · qualcomm/sd 205 firmware · qualcomm/sd 425 firmware · qualcomm/sd 439 firmware · qualcomm/sd 429 firmware · +16 more
- Source
- product-security@qualcomm.com
References
- https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletinPatch, Third Party Advisory
- https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletinPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.