High severity · published Oct 29, 2018
CVE-2018-11884
Improper input validation leads to buffer overflow while processing network list offload command in WLAN function in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660
7.8
CVSS
0.2%
EPSS
No
On KEV
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S8
SD 835 Firmware · Qualcomm
All versions, or not specified · source: NVD
S8
SD 845 Firmware · Qualcomm
All versions, or not specified · source: NVD
S8
SD 850 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda660 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11884
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11884
www.securityfocus.com
http://www.securityfocus.com/bid/107681
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins
More from SD 835 Firmware
9.8
CVE-2017-17772
In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation
9.8
CVE-2017-11076
On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory…
9.8
CVE-2019-2332
Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial…
9.8
CVE-2019-2331
Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…
9.8
CVE-2019-2325
Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…