CVE-2017-18280 Information disclosure in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

High 7.8 Published 20 Sep 2018 Updated 5 Aug 2024

A Trusted Application can read data from an open SPI/I2C interface accessed by another Trusted Application, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-18280?

CVE-2017-18280 is a high-severity vulnerability in Qualcomm Mdm9607 Firmware, published on 20 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has opened the SPI/I2C interface to a particular device, it is possible for another Trusted Application to read the data on this open interface by calling the SPI/I2C read function.

Which versions are affected by CVE-2017-18280?

It affects 21 products.

Products include Qualcomm Mdm9607 Firmware, Qualcomm Msm8909w Firmware, Qualcomm Msm8996au Firmware, Qualcomm Sd205 Firmware, Qualcomm Sd210 Firmware, Qualcomm Sd212 Firmware and 15 more.

How do I fix CVE-2017-18280?

No fix has been published for CVE-2017-18280 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-18280 being exploited?

There is no known exploitation of CVE-2017-18280 in the wild and no public exploit code.

All Qualcomm Mdm9607 Firmware vulnerabilities

Sources

Also known as GHSA-985h-j93g-9259.