Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Qualcomm Snapdragon firmware may write to invalid memory

CVE-2018-3592 · published 8 years ago
Summary

Android devices using certain Qualcomm Snapdragon chips can write data to a memory location that should have been cleared first. This can cause the device to crash or behave unpredictably. Apply the Android security update released after 2018‑04‑05 or upgrade the device firmware to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm mdm9206_firmware All versions
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9607_firmware All versions
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9635m_firmware All versions
cpe:2.3:o:qualcomm:mdm9635m_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9640_firmware All versions
cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9645_firmware All versions
cpe:2.3:o:qualcomm:mdm9645_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9650_firmware All versions
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9655_firmware All versions
cpe:2.3:o:qualcomm:mdm9655_firmware:-:*:*:*:*:*:*:*
qualcomm msm8909w_firmware All versions
cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*
qualcomm sd_210_firmware All versions
cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
qualcomm sd_212_firmware All versions
cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
qualcomm sd_205_firmware All versions
cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
qualcomm sd_425_firmware All versions
cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
qualcomm sd_430_firmware All versions
cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
qualcomm sd_450_firmware All versions
cpe:2.3:o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
qualcomm sd_625_firmware All versions
cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
qualcomm sd_650_firmware All versions
cpe:2.3:o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:*
qualcomm sd_652_firmware All versions
cpe:2.3:o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820_firmware All versions
cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*
qualcomm sd_835_firmware All versions
cpe:2.3:o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:*
qualcomm sd_845_firmware All versions
cpe:2.3:o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
qualcomm sd_850_firmware All versions
cpe:2.3:o:qualcomm:sd_850_firmware:-:*:*:*:*:*:*:*
Original advisory text
In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, S...
In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, added a change to check if the pointer has been reset to NULL or not, before writing to the memory pointed by the pointer.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published11 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-3592 · NVD
Track software like this
Free during beta