CVE-2017-18172 Integer overflow in Snapdragon Automobile, Snapdragon Mobile
An integer overflow in System UI allows attackers to execute arbitrary code or escalate privileges on affected Qualcomm Snapdragon devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-18172?
CVE-2017-18172 is a high-severity vulnerability in Qualcomm Mdm9635m Firmware, published on 23 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer Overflow or Wraparound in System UI in Snapdragon Automobile, Snapdragon Mobile in version MDM9635M, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016.
Weakness: CWE-190
Which versions are affected by CVE-2017-18172?
It affects 24 products.
Products include Qualcomm Mdm9635m Firmware, Qualcomm Sd 400 Firmware, Qualcomm Sd 410 Firmware, Qualcomm Sd 412 Firmware, Qualcomm Sd 415 Firmware, Qualcomm Sd 425 Firmware and 18 more.
How do I fix CVE-2017-18172?
No fix has been published for CVE-2017-18172 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-18172 being exploited?
There is no known exploitation of CVE-2017-18172 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Mdm9635m Firmware
- CVE-2017-18160 Hardcoded credentials in Snapdragon Mobile, Snapdragon Wear
- CVE-2014-9985 Race condition in Snapdragon Mobile
- CVE-2016-10494 Integer overflow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
- CVE-2016-10495 Integer overflow in Snapdragon Mobile
- CVE-2016-10496 Null dereference in Snapdragon Mobile
Sources
Also known as GHSA-m284-7q72-8635.