CVE-2015-9196 Privilege escalation in Snapdragon Mobile, Small Cell SoC
Improper input validation in Qualcomm Snapdragon SoCs allows attackers to escalate privileges on Android devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-9196?
CVE-2015-9196 is a critical vulnerability in Qualcomm Mdm9635m Firmware, published on 18 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, MDM9635M, SD 400, and SD 800, improper input validation in tzbsp_ocmem can cause privilege escalation.
Which versions are affected by CVE-2015-9196?
It affects 4 products.
Products include Qualcomm Fsm9055 Firmware, Qualcomm Mdm9635m Firmware, Qualcomm Sd 400 Firmware, Qualcomm Sd 800 Firmware.
How do I fix CVE-2015-9196?
No fix has been published for CVE-2015-9196 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-9196 being exploited?
There is no known exploitation of CVE-2015-9196 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Mdm9635m Firmware
- CVE-2014-10052 Information disclosure in Snapdragon Mobile, Snapdragon Wear, Small Cell SoC
- CVE-2015-9138 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Small Cell SoC
- CVE-2015-9224 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Small Cell SoC
- CVE-2016-10412 Integer overflow in Small Cell SoC , Snapdragon Mobile, Snapdragon Wear
- CVE-2016-10422 Missing authorization in Small Cell SoC , Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Sources
Also known as GHSA-w7w7-8vhp-hxvq.