Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Qualcomm Snapdragon firmware may expose hardware to unauthorized apps

CVE-2016-10444 · published 8 years ago
Summary

Older versions of Qualcomm Snapdragon firmware used in certain Android devices (such as MDM9206, SD‑210, SD‑212, SD‑205, and SD‑425) do not prevent the main operating system from reaching low‑level hardware blocks called BLSP and BAM. This could allow a malicious app to interact with those components and potentially gain higher privileges or cause instability. Update the device to the Android security patch released on April 5 2018 or later, or install the latest firmware from the device maker.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm mdm9206_firmware All versions
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcomm sd_210_firmware All versions
cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
qualcomm sd_212_firmware All versions
cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
qualcomm sd_205_firmware All versions
cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
qualcomm sd_425_firmware All versions
cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
qualcomm sd_430_firmware All versions
cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
qualcomm sd_450_firmware All versions
cpe:2.3:o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
qualcomm sd_625_firmware All versions
cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
qualcomm sd_835_firmware All versions
cpe:2.3:o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820_firmware All versions
cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820a_firmware All versions
cpe:2.3:o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:*
Original advisory text
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625,...
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, and SD 835, SMMU Access Control Policy was updated to block HLOS from accessing BLSP and BAM resources.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published18 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-10444 · NVD
Track software like this
Free during beta