CVE-2017-18140 : What You Need to Know

Android devices with security patch level earlier than 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear are affected by a code error leading to a Use After Free condition.

Understanding CVE-2017-18140

In April 2018, CVE-2017-18140 was published, highlighting a vulnerability in Qualcomm Snapdragon devices.

What is CVE-2017-18140?

The vulnerability involves the unintentional printing of the RIL token-id to the debug log during the call disconnection process on specific Qualcomm Snapdragon devices.

The Impact of CVE-2017-18140

The issue could potentially result in a Use After Free condition, especially if the eMBMS service is enabled.

Technical Details of CVE-2017-18140

Qualcomm Snapdragon devices are susceptible to a critical security flaw.

Vulnerability Description

The vulnerability allows the RIL token-id to be printed to the debug log during call disconnection, potentially leading to a Use After Free condition.

Affected Systems and Versions

Products: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Versions: MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845

Exploitation Mechanism

The vulnerability occurs when the eMBMS service is enabled during the call disconnection process.

Mitigation and Prevention

Steps to address and prevent the CVE-2017-18140 vulnerability.

Immediate Steps to Take

Apply security patch level 2018-04-05 or later on affected devices.
Disable the eMBMS service if not required.

Long-Term Security Practices

Regularly update devices with the latest security patches.
Monitor security bulletins and advisories from Qualcomm.

Patching and Updates

Ensure all Qualcomm Snapdragon devices are updated with the latest security patches to mitigate the vulnerability.