Google Android on Snapdragon Qualcomm 7pk security

Summaryinfo

A vulnerability was found in Google Android on Snapdragon and classified as problematic. This vulnerability affects unknown code of the component Qualcomm. The manipulation results in 7pk security. This vulnerability is cataloged as CVE-2017-18126. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as critical has been found in Google Android on Snapdragon (Smartphone Operating System) (the affected version is unknown). Affected is an unknown code of the component Qualcomm. The manipulation with an unknown input leads to a 7pk security vulnerability. CWE is classifying the issue as CWE-254. This is going to have an impact on confidentiality, and integrity. CVE summarizes:

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the original mac spoofing feature does not use the following in probe request frames: (a) randomized sequence numbers and (b) randomized source address for cfg80211 scan, vendor scan and pno scan which may affect user privacy.

The bug was discovered 04/04/2018. The weakness was shared 04/11/2018 (Website). The advisory is shared for download at source.android.com. This vulnerability is traded as CVE-2017-18126 since 02/05/2018. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/24/2020). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1211.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103671†). The entries VDB-83180, VDB-105483, VDB-105484 and VDB-105488 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion