CVE-2018-13906 in Snapdragon Auto

Riassunto

di VulDB • 24/06/2026

L'HMAC che autentica il messaggio proveniente da QSEE è vulnerabile ad analisi side-channel basate sui tempi di esecuzione (timing attack), portando potenzialmente alla falsificazione del messaggio dell'applicazione in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking nei dispositivi IPQ4019, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016 e SXR1130.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Prenotare: 11/07/2018
• Moderazione: accettato
• Voce: VDB-136491
• CPE: pronto
• CWE: CWE-20 (confermato)
• CVSS: 9.1 (NVD)
• EPSS: 0.00665
• KEV: no
• Attività: molto basso
• Settore: Agriculture, Pharma, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2018-13906
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-13906
• CVE Details: https://www.cvedetails.com/cve/CVE-2018-13906/