7.8high
CVE-2017-18304
Insufficient memory allocation in boot due to incorrect size being passed could result in out of bounds access in Small Cell SoC, Snapdrago…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 18%
Public exploits
0
none known
Summary
Insufficient memory allocation in boot due to incorrect size being passed could result in out of bounds access in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660 and SDX20
Exploit prediction (EPSS)
0.26% probability of exploitation in the next 30 days, higher than 18% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Qualcomm, Inc. Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Classification
- Weakness
- CWE-125 Out-of-bounds Read
References
- qualcomm.com /company/product-security/bulletins · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1041432 · vdb-entry, x_refsource_SECTRACK, x_transferred
- source.android.com /security/bulletin/2018-08-01#qualcomm-closed-source-components · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-18304
- NVD: CVE-2017-18304
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.