CVE-2017-18173 Integer overflow in Snapdragon Mobile
An integer underflow in Qualcomm Snapdragon Mobile verified boot allows attackers to potentially execute code or escalate privileges via a malicious signature.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-18173?
CVE-2017-18173 is a high-severity vulnerability in Qualcomm Sd 425 Firmware, published on 6 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In case of using an invalid android verified boot signature with very large length, an integer underflow occurs in Snapdragon Mobile in SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 810, SD 820, SD 835, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016.
Weakness: CWE-190
Which versions are affected by CVE-2017-18173?
It affects 13 products.
Products include Qualcomm Sd 425 Firmware, Qualcomm Sd 427 Firmware, Qualcomm Sd 430 Firmware, Qualcomm Sd 435 Firmware, Qualcomm Sd 450 Firmware, Qualcomm Sd 625 Firmware and 7 more.
How do I fix CVE-2017-18173?
No fix has been published for CVE-2017-18173 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-18173 being exploited?
There is no known exploitation of CVE-2017-18173 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Sd 425 Firmware
- CVE-2015-9110 Missing authorization in Snapdragon Automobile, Snapdragon Mobile
- CVE-2015-9114 Null dereference in Snapdragon Automobile, Snapdragon Mobile
- CVE-2016-10430 Information disclosure in Snapdragon Automobile, Snapdragon Mobile
- CVE-2016-10440 Missing authorization in Snapdragon Mobile
- CVE-2016-10454 Memory corruption in Snapdragon Mobile
Sources
Also known as GHSA-76c4-v6jr-cw4h.