CVE-2016-10433 Race condition in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
A time-of-check time-of-use race condition in Qualcomm Snapdragon firmware allows attackers to cause memory corruption and potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10433?
CVE-2016-10433 is a high-severity vulnerability in Qualcomm Mdm9635m Firmware, published on 18 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, TOCTOU vulnerability during SSD image decryption may cause memory corruption.
Which versions are affected by CVE-2016-10433?
It affects 24 products.
Products include Qualcomm Mdm9635m Firmware, Qualcomm Mdm9640 Firmware, Qualcomm Mdm9645 Firmware, Qualcomm Msm8909w Firmware, Qualcomm Sd 205 Firmware, Qualcomm Sd 210 Firmware and 18 more.
How do I fix CVE-2016-10433?
No fix has been published for CVE-2016-10433 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-10433 being exploited?
There is no known exploitation of CVE-2016-10433 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Mdm9635m Firmware
- CVE-2017-18160 Hardcoded credentials in Snapdragon Mobile, Snapdragon Wear
- CVE-2014-9985 Race condition in Snapdragon Mobile
- CVE-2016-10494 Integer overflow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
- CVE-2016-10495 Integer overflow in Snapdragon Mobile
- CVE-2016-10496 Null dereference in Snapdragon Mobile
Sources
Also known as GHSA-ww6v-cqpf-xp9h.