CVE-2015-9132 Null dereference in Snapdragon Mobile,Small Cell SoC

What is CVE-2015-9132?

CVE-2015-9132 is a high-severity vulnerability in Qualcomm Sd 205 Firmware, published on 18 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, possible arbitrary memory read due to untrusted pointer dereference when handling HLOS controlled values passed to the QSEE syscall helper.

Weakness: CWE-476

Which versions are affected by CVE-2015-9132?

It affects 12 products.

Products include Qualcomm Fsm9055 Firmware, Qualcomm Sd 205 Firmware, Qualcomm Sd 210 Firmware, Qualcomm Sd 212 Firmware, Qualcomm Sd 400 Firmware, Qualcomm Sd 410 Firmware and 6 more.

How do I fix CVE-2015-9132?

No fix has been published for CVE-2015-9132 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-9132 being exploited?

There is no known exploitation of CVE-2015-9132 in the wild and no public exploit code.

Other vulnerabilities in Qualcomm Sd 205 Firmware

• CVE-2014-10052 Information disclosure in Snapdragon Mobile, Snapdragon Wear, Small Cell SoC Critical 9.8
• CVE-2015-9138 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Small Cell SoC Critical 9.8
• CVE-2015-9196 Privilege escalation in Snapdragon Mobile, Small Cell SoC Critical 9.8
• CVE-2015-9224 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Small Cell SoC Critical 9.8
• CVE-2016-10412 Integer overflow in Small Cell SoC , Snapdragon Mobile, Snapdragon Wear Critical 9.8

All Qualcomm Sd 205 Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8683-ppgv-pqp4.