High severity · published Oct 29, 2018
CVE-2018-11880
Incorrect bound check can lead to potential buffer overwrite in WLAN function in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Incorrect bound check can lead to potential buffer overwrite in WLAN function in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S8
SD 835 Firmware · Qualcomm
All versions, or not specified · source: NVD
S8
SD 845 Firmware · Qualcomm
All versions, or not specified · source: NVD
S8
SD 850 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda660 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11880
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11880
www.securityfocus.com
http://www.securityfocus.com/bid/107681
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins
More from SD 835 Firmware
9.8
CVE-2017-17772
Multiple buffer overread vulnerabilities in WLAN
9.8
CVE-2017-11076
Use of Out-of-range Pointer Offset in Video
9.8
CVE-2019-2332
Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial…
9.8
CVE-2019-2331
Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…
9.8
CVE-2019-2325
Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…