Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-18140: Qualcomm Snapdragon Android may crash on call disconnect

CVE-2017-18140 · published 8 years ago

Summary

Android devices that use Qualcomm Snapdragon chips and have not installed the April 5 2018 security update are vulnerable. When a phone call ends while a certain broadcast service is active, the system can try to use memory that has already been released, potentially causing a crash or instability. Apply the latest security patch from the device manufacturer or update the Android version to resolve the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
qualcomm	mdm9206_firmware	All versions `cpe:2.3:o:qualcomm:mdm9206_firmware:-:::::::*`
qualcomm	mdm9607_firmware	All versions `cpe:2.3:o:qualcomm:mdm9607_firmware:-:::::::*`
qualcomm	mdm9650_firmware	All versions `cpe:2.3:o:qualcomm:mdm9650_firmware:-:::::::*`
qualcomm	msm8909w_firmware	All versions `cpe:2.3:o:qualcomm:msm8909w_firmware:-:::::::*`
qualcomm	sd_210_firmware	All versions `cpe:2.3:o:qualcomm:sd_210_firmware:-:::::::*`
qualcomm	sd_212_firmware	All versions `cpe:2.3:o:qualcomm:sd_212_firmware:-:::::::*`
qualcomm	sd_205_firmware	All versions `cpe:2.3:o:qualcomm:sd_205_firmware:-:::::::*`
qualcomm	sd_400_firmware	All versions `cpe:2.3:o:qualcomm:sd_400_firmware:-:::::::*`
qualcomm	sd_425_firmware	All versions `cpe:2.3:o:qualcomm:sd_425_firmware:-:::::::*`
qualcomm	sd_430_firmware	All versions `cpe:2.3:o:qualcomm:sd_430_firmware:-:::::::*`
qualcomm	sd_450_firmware	All versions `cpe:2.3:o:qualcomm:sd_450_firmware:-:::::::*`
qualcomm	sd_615_firmware	All versions `cpe:2.3:o:qualcomm:sd_615_firmware:-:::::::*`
qualcomm	sd_616_firmware	All versions `cpe:2.3:o:qualcomm:sd_616_firmware:-:::::::*`
qualcomm	sd_415_firmware	All versions `cpe:2.3:o:qualcomm:sd_415_firmware:-:::::::*`
qualcomm	sd_617_firmware	All versions `cpe:2.3:o:qualcomm:sd_617_firmware:-:::::::*`
qualcomm	sd_625_firmware	All versions `cpe:2.3:o:qualcomm:sd_625_firmware:-:::::::*`
qualcomm	sd_650_firmware	All versions `cpe:2.3:o:qualcomm:sd_650_firmware:-:::::::*`
qualcomm	sd_652_firmware	All versions `cpe:2.3:o:qualcomm:sd_652_firmware:-:::::::*`
qualcomm	sd_820a_firmware	All versions `cpe:2.3:o:qualcomm:sd_820a_firmware:-:::::::*`
qualcomm	sd_808_firmware	All versions `cpe:2.3:o:qualcomm:sd_808_firmware:-:::::::*`
qualcomm	sd_810_firmware	All versions `cpe:2.3:o:qualcomm:sd_810_firmware:-:::::::*`
qualcomm	sd_820_firmware	All versions `cpe:2.3:o:qualcomm:sd_820_firmware:-:::::::*`
qualcomm	sd_835_firmware	All versions `cpe:2.3:o:qualcomm:sd_835_firmware:-:::::::*`
qualcomm	sd_845_firmware	All versions `cpe:2.3:o:qualcomm:sd_845_firmware:-:::::::*`

Original advisory text

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, when processing a call disconnection, there is an attempt to print the RIL token-id to the debug log. If eMBMS service is enabled while processing the call disconnect, a Use After Free condition may potentially occur.

References

http://www.securityfocus.com/bid/103671 Third Party Advisory VDB Entry
https://source.android.com/security/bulletin/2018-04-01 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published11 Apr 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-18140 · NVD

Track software like this

Free during beta