CVE-2017-18301 Null dereference in n/a

What is CVE-2017-18301?

CVE-2017-18301 is a medium-severity vulnerability in Qualcomm Mdm9607 Firmware, published on 20 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Small Cell SoC and Snapdragon (Automobile, Mobile, Wear) in version FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, providing the NULL argument of ICE regulator while processing create key IOCTL results in system restart.

Weakness: CWE-476

Which versions are affected by CVE-2017-18301?

It affects 23 products.

Products include Qualcomm Fsm9055 Firmware, Qualcomm Fsm9955 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9640 Firmware, Qualcomm Mdm9650 Firmware, Qualcomm Msm8909w Firmware and 17 more.

How do I fix CVE-2017-18301?

No fix has been published for CVE-2017-18301 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-18301 being exploited?

There is no known exploitation of CVE-2017-18301 in the wild and no public exploit code.

Other vulnerabilities in Qualcomm Mdm9607 Firmware

• CVE-2014-10052 Information disclosure in Snapdragon Mobile, Snapdragon Wear, Small Cell SoC Critical 9.8
• CVE-2015-9138 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Small Cell SoC Critical 9.8
• CVE-2015-9196 Privilege escalation in Snapdragon Mobile, Small Cell SoC Critical 9.8
• CVE-2015-9224 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Small Cell SoC Critical 9.8
• CVE-2016-10412 Integer overflow in Small Cell SoC , Snapdragon Mobile, Snapdragon Wear Critical 9.8

All Qualcomm Mdm9607 Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g8pp-68w8-fg6c.