CVE-2018-11828 Denial of service in Snapdragon Mobile
A flaw in Snapdragon Mobile firmware causes a denial of service by trapping the device in an infinite loop when random number generation fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11828?
CVE-2018-11828 is a high-severity denial of service vulnerability in Qualcomm Sd 205 Firmware, published on 26 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When FW tries to get random mac address generated from new SW RNG and ADC values read are constant then DUT get struck in loop while trying to get random ADC samples in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52
Weakness: CWE-400
Which versions are affected by CVE-2018-11828?
It affects 9 products.
Products include Qualcomm Sd 205 Firmware, Qualcomm Sd 210 Firmware, Qualcomm Sd 212 Firmware, Qualcomm Sd 425 Firmware, Qualcomm Sd 430 Firmware, Qualcomm Sd 450 Firmware and 3 more.
How do I fix CVE-2018-11828?
No fix has been published for CVE-2018-11828 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-11828 being exploited?
There is no known exploitation of CVE-2018-11828 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Sd 205 Firmware
- CVE-2014-10056 Memory corruption in Snapdragon Mobile
- CVE-2015-9205 Memory corruption in Snapdragon Mobile, Snapdragon Wear
- CVE-2016-10407 Integer overflow in Snapdragon Mobile
- CVE-2016-10458 Memory corruption in Snapdragon Mobile
- CVE-2016-10467 Weak cryptography in Snapdragon Automobile, Snapdragon Mobile
Sources
Also known as GHSA-6qj9-7qwq-529x.