Vulnerabilities > CVE-2018-13905 - Use After Free vulnerability in Qualcomm products

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

qualcomm

CWE-416

NVD

Published: 2019-02-25

Updated: 2019-02-27

Summary

KGSL syncsource lock not handled properly during syncsource cleanup can lead to use after free issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, SD 210/SD 212/SD 205, SD 439 / SD 429, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX24.

Vulnerable Configurations

Part	Description	Count
OS	Qualcomm Qualcomm Mdm9206 Firmware - Qualcomm Mdm9607 Firmware - Qualcomm Mdm9650 Firmware - Qualcomm Msm8909W Firmware - Qualcomm Qcs605 Firmware - Qualcomm SD 210 Firmware - Qualcomm SD 212 Firmware - Qualcomm SD 205 Firmware - Qualcomm SD 439 Firmware - Qualcomm SD 429 Firmware - Qualcomm SD 712 Firmware - Qualcomm SD 710 Firmware - Qualcomm SD 670 Firmware - Qualcomm SD 820A Firmware - Qualcomm SD 845 Firmware - Qualcomm SD 850 Firmware - Qualcomm SD 855 Firmware - Qualcomm Sdm439 Firmware - Qualcomm Sdm660 Firmware - Qualcomm Sdx24 Firmware -	20
Hardware	Qualcomm Qualcomm Mdm9206 - Qualcomm Mdm9607 - Qualcomm Mdm9650 - Qualcomm Msm8909W - Qualcomm Qcs605 - Qualcomm SD 210 - Qualcomm SD 212 - Qualcomm SD 205 - Qualcomm SD 439 - Qualcomm SD 429 - Qualcomm SD 712 - Qualcomm SD 710 - Qualcomm SD 670 - Qualcomm SD 820A - Qualcomm SD 845 - Qualcomm SD 850 - Qualcomm SD 855 - Qualcomm Sdm439 - Qualcomm Sdm660 - Qualcomm Sdx24 -	20

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References