Memory Overread Vulnerability in Qualcomm Snapdragon Devices

Memory Overread Vulnerability in Qualcomm Snapdragon Devices

CVE-2014-9986 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, in playready_licacq_process_response(), 'cbResponse' value is controlled by HLOS, and there is no validation on this length. If 'cbResponse' is too large, memory overread occurs.

Learn more about our Cis Benchmark Audit For Google Android.