CVE-2017-15841 Denial of service in Snapdragon Mobile

What is CVE-2017-15841?

CVE-2017-15841 is a medium-severity denial of service vulnerability in Qualcomm Sd 410 Firmware, published on 6 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

When HOST sends a Special command ID packet, Controller triggers a RAM Dump and FW reset in Snapdragon Mobile in version SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, Snapdragon_High_Med_2016.

Which versions are affected by CVE-2017-15841?

It affects 16 products.

Products include Qualcomm Sd 410 Firmware, Qualcomm Sd 412 Firmware, Qualcomm Sd 415 Firmware, Qualcomm Sd 425 Firmware, Qualcomm Sd 427 Firmware, Qualcomm Sd 430 Firmware and 10 more.

How do I fix CVE-2017-15841?

No fix has been published for CVE-2017-15841 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-15841 being exploited?

There is no known exploitation of CVE-2017-15841 in the wild and no public exploit code.

Other vulnerabilities in Qualcomm Sd 410 Firmware

• CVE-2015-9162 Null dereference in Snapdragon Mobile Critical 9.8
• CVE-2015-9167 Integer overflow in Snapdragon Automobile, Snapdragon Mobile Critical 9.8
• CVE-2015-9173 Memory corruption in Snapdragon Mobile Critical 9.8
• CVE-2015-9174 Memory corruption in Snapdragon Mobile Critical 9.8
• CVE-2015-9183 Integer overflow in Snapdragon Mobile Critical 9.8

All Qualcomm Sd 410 Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qqg7-8p4x-2v23.