In Android prior to 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in widevine_dash_cmd_handler(), rsp buffers are passed off to widevine commands. These rsp buffers have values in them, such as buffer lengths, that need to be validated to ensure that no buffer overflow/over-reads happen. However, rsp buffers are not always in locked memory, meaning a time-of-check, time-of-use issue can occur where we check that the value is valid, but then a race condition occurs where this memory is swapped out with a different, possibly out of range, value.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
qualcomm mdm9206_firmware - |
||
qualcomm mdm9607_firmware - |
||
qualcomm ipq4019_firmware - |
||
qualcomm mdm9625_firmware - |
||
qualcomm mdm9635m_firmware - |
||
qualcomm msm8909w_firmware - |
||
qualcomm sd_210_firmware - |
||
qualcomm sd_212_firmware - |
||
qualcomm sd_205_firmware - |
||
qualcomm sd_400_firmware - |
||
qualcomm sd_410_firmware - |
||
qualcomm sd_412_firmware - |
||
qualcomm sd_600_firmware - |
||
qualcomm sd_615_firmware - |
||
qualcomm sd_616_firmware - |
||
qualcomm sd_415_firmware - |
||
qualcomm sd_617_firmware - |
||
qualcomm sd_650_firmware - |
||
qualcomm sd_652_firmware - |
||
qualcomm sd_800_firmware - |
||
qualcomm sd_808_firmware - |
||
qualcomm sd_810_firmware - |
Vulmon