CVE-2019-2278 User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer

What is CVE-2019-2278?

CVE-2019-2278 is a high-severity vulnerability in Qualcomm Mdm9607 Firmware, published on 25 Jul 2019.

Official description

User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660

Weakness: CWE-347

Which versions are affected by CVE-2019-2278?

It affects 15 products.

Products include Qualcomm Mdm9607 Firmware, Qualcomm Mdm9640 Firmware, Qualcomm Sd 425 Firmware, Qualcomm Sd 427 Firmware, Qualcomm Sd 430 Firmware, Qualcomm Sd 435 Firmware and 9 more.

How do I fix CVE-2019-2278?

No fix has been published for CVE-2019-2278 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-2278 being exploited?

There is no known exploitation of CVE-2019-2278 in the wild and no public exploit code.

Other vulnerabilities in Qualcomm Mdm9607 Firmware

• CVE-2019-10531 Memory corruption in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables Critical 9.8
• CVE-2019-2276 Memory corruption in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music Critical 9.8
• CVE-2018-5915 Denial of service in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear Critical 9.8
• CVE-2015-9126 Memory corruption in Snapdragon Mobile, Snapdragon Wear Critical 9.8
• CVE-2016-10479 Memory corruption in Snapdragon Mobile Critical 9.8

All Qualcomm Mdm9607 Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mhq7-486h-2f4f.