CVE-2017-18649: High severity android vulnerability

Published Apr 7, 2020

Updated

An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can boot a device with root privileges because the bootloader for the Qualcomm MSM8998 chipset lacks an integrity check of the system image, aka the "SamFAIL" issue. The Samsung ID is SVE-2017-10465 (November 2017).

Affected Software

5 affected components

Google Android=7.0

Google Android=7.1.0

Google Android=7.1.1

Google Android=7.1.2

Qualcomm MSM8998

Event History

Apr 7, 2020

CVE Published

via MITRE·03:54 PM

Data Sourced

via MITRE·03:54 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-18649?

CVE-2017-18649 is considered a critical vulnerability as it allows attackers to boot Samsung devices with root privileges.

How do I fix CVE-2017-18649?

To mitigate CVE-2017-18649, users should update their Samsung mobile devices to the latest software version provided by Samsung.

Which devices are affected by CVE-2017-18649?

CVE-2017-18649 affects various Samsung mobile devices that run Android N (7.x) with Qualcomm MSM8998 chipsets.

What type of attack is possible due to CVE-2017-18649?

An attacker can exploit CVE-2017-18649 to gain unauthorized root access by bypassing the bootloader's integrity check.

When was CVE-2017-18649 disclosed?

CVE-2017-18649 was disclosed in November 2017, along with the related Samsung ID SVE-2017-10465.