CVE-2018-13903 Race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

High 8.1 Published 8 Sep 2020 Updated 5 Aug 2024

A race condition in EPCO handling within Qualcomm Snapdragon firmware can lead to a null pointer dereference and denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-13903?

CVE-2018-13903 is a high-severity vulnerability in Qualcomm Apq8053 Firmware, published on 8 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9205, MDM9206, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, SDM450, SM8150

Weakness: CWE-476, CWE-362

Which versions are affected by CVE-2018-13903?

It affects 11 products.

Products include Qualcomm Apq8053 Firmware, Qualcomm Mdm9205 Firmware, Qualcomm Mdm9206 Firmware, Qualcomm Msm8909w Firmware, Qualcomm Msm8917 Firmware, Qualcomm Msm8920 Firmware and 5 more.

How do I fix CVE-2018-13903?

No fix has been published for CVE-2018-13903 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-13903 being exploited?

There is no known exploitation of CVE-2018-13903 in the wild and no public exploit code.

All Qualcomm Apq8053 Firmware vulnerabilities

Sources

Also known as GHSA-qjjp-x2wp-m9g9.