CVE-2018-11259: qualcomm, inc. snapdragon automobile, snapdragon mobile, snapdragon wear

Vulnerability summary

CVE-2018-11259 is a high (CVSS 7.7) vulnerability in qualcomm, inc. snapdragon automobile, snapdragon mobile, snapdragon wear. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.

Timeline

1. 06-07-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and configures the EFS partition addresses in its MPU partition.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.