Published on May 25th, 2019 📆 | 4385 Views ⚑
0Qualcomm Snapdragon Auto up to SDX20 Content Provider privilege escalation
CVSS Meta Temp Score | Current Exploit Price (≈) |
---|---|
5.5 | $0-$5k |
A vulnerability was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IoT, Snapdragon IoT, Snapdragon Mobile and Snapdragon Wearables. It has been classified as critical. This affects code of the component Content Provider. The manipulation with an unknown input leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-269. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
The weakness was disclosed 05/24/2019. The advisory is shared at qualcomm.com. This vulnerability is uniquely identified as CVE-2018-13895 since 07/11/2018. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/25/2019).
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The entries 135534, 135535, 135536 and 135538 are pretty similar.
Vendor
Name
VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.5
VulDB Base Score: ≈5.5
VulDB Temp Score: ≈5.5
VulDB Vector: ?
VulDB Reliability: ?
VulDB Base Score: ?
VulDB Temp Score: ?
VulDB Reliability: ?
Class: Privilege escalation (CWE-269)
Local: Yes
Remote: No
Availability: ?
Status: Not defined
Current Price Estimation: ?
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Price Prediction: ?
Threat Intelligence
Threat: ?
Adversaries: ?
Geopolitics: ?
Economy: ?
Predictions: ?
Remediation: ?Recommended: no mitigation known
0-Day Time: ?
07/11/2018 CVE assigned
05/24/2019 Advisory disclosed
05/25/2019 VulDB entry created
05/25/2019 VulDB last updateVendor: qualcomm.com
Advisory: qualcomm.com
CVE: CVE-2018-13895 (?)
See also: ?
Created: 05/25/2019 10:58 AM
Complete: ?
Upgrade your account now!
https://vuldb.com/?id.135537
Gloss