CVE-2018-11976

24.05.2019, 17:29

ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
qualcomm	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 13%

Vendor	Product	Version
qualcomm	ipq8074_firmware	-
qualcomm	mdm9150_firmware	-
qualcomm	mdm9206_firmware	-
qualcomm	mdm9607_firmware	-
qualcomm	mdm9650_firmware	-
qualcomm	mdm9655_firmware	-
qualcomm	msm8909w_firmware	-
qualcomm	msm8996au_firmware	-
qualcomm	qca8081_firmware	-
qualcomm	qcs605_firmware	-
qualcomm	qm215_firmware	-
qualcomm	sd_210_firmware	-
qualcomm	sd_212_firmware	-
qualcomm	sd_205_firmware	-
qualcomm	sd_410_firmware	-
qualcomm	sd_412_firmware	-
qualcomm	sd_425_firmware	-
qualcomm	sd_427_firmware	-
qualcomm	sd_430_firmware	-
qualcomm	sd_435_firmware	-
qualcomm	sd_439_firmware	-
qualcomm	sd_429_firmware	-
qualcomm	sd_450_firmware	-
qualcomm	sd_615_firmware	-
qualcomm	sd_616_firmware	-
qualcomm	sd_415_firmware	-
qualcomm	sd_625_firmware	-
qualcomm	sd_632_firmware	-
qualcomm	sd_636_firmware	-
qualcomm	sd_650_firmware	-
qualcomm	sd_652_firmware	-
qualcomm	sd_712_firmware	-
qualcomm	sd_710_firmware	-
qualcomm	sd_670_firmware	-
qualcomm	sd_820_firmware	-
qualcomm	sd_820a_firmware	-
qualcomm	sd_835_firmware	-
qualcomm	sd_845_firmware	-
qualcomm	sd_850_firmware	-
qualcomm	sd_8cx_firmware	-
qualcomm	sda660_firmware	-
qualcomm	sdm439_firmware	-
qualcomm	sdm630_firmware	-
qualcomm	sdm660_firmware	-
qualcomm	snapdragon_high_med_2016_firmware	-
qualcomm	sxr1130_firmware	-

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11976