CVE-2015-9179 Memory corruption in Snapdragon Mobile
A buffer overflow in Qualcomm Snapdragon Mobile allows attackers to execute arbitrary code via improper length checking in key derivation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-9179?
CVE-2015-9179 is a critical memory corruption vulnerability in Qualcomm, Inc. Snapdragon Mobile, published on 18 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974, lack of length checking in OEMCrypto_DeriveKeysFromSessionKey() could lead to a buffer overflow vulnerability.
Weakness: CWE-119
Which versions are affected by CVE-2015-9179?
It affects 1 product.
Products include Qualcomm Msm8974 Firmware.
How do I fix CVE-2015-9179?
No fix has been published for CVE-2015-9179 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-9179 being exploited?
There is no known exploitation of CVE-2015-9179 in the wild and no public exploit code.
Sources
Also known as GHSA-xpm8-574h-3525.