CVE-2018-11290: Weak RNG
First published: Tue Sep 04 2018(Updated: )
In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820A, SD 845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, MAC address randomization performed during probe requests is not done properly due to a flawed RNG in use.
Credit: product-security@qualcomm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Android | ||
| Qualcomm MDM9206 | ||
| Qualcomm MDM9206 firmware | ||
| Qualcomm MD9607 Firmware | ||
| Qualcomm MDM9607 firmware | ||
| qualcomm mdm9640 firmware | ||
| Qualcomm MDM9640 | ||
| Qualcomm MDM9650 | ||
| Qualcomm MDM9650 firmware | ||
| qualcomm MSM8996AU firmware | ||
| Qualcomm MSM8996AU Firmware | ||
| Qualcomm QCA6574 Firmware | ||
| Qualcomm QCA6574AU | ||
| Qualcomm SD 210 Firmware | ||
| Qualcomm SD210 Firmware | ||
| Qualcomm SD 212 Firmware | ||
| Qualcomm SD 212 | ||
| Qualcomm SD 205 Firmware | ||
| Qualcomm Snapdragon 205 | ||
| Qualcomm SD425 Firmware | ||
| Qualcomm Snapdragon 425 | ||
| Qualcomm SD427 Firmware | ||
| Qualcomm SD427 Firmware | ||
| Qualcomm SD 430 Firmware | ||
| Qualcomm Snapdragon 430 | ||
| Qualcomm SD 435 firmware | ||
| Qualcomm Snapdragon 435 | ||
| Qualcomm SD 450 Firmware | ||
| Qualcomm Snapdragon 450 | ||
| Qualcomm SD 625 Firmware | ||
| Qualcomm Snapdragon 625 | ||
| Qualcomm SD 650 Firmware | ||
| Qualcomm Snapdragon 650 | ||
| Qualcomm SD 652 Firmware | ||
| Qualcomm SD652 Firmware | ||
| Qualcomm SD 820A firmware | ||
| Qualcomm SD820A Firmware | ||
| Qualcomm SD 845 Firmware | ||
| Qualcomm Snapdragon 845 | ||
| Qualcomm SDM429W | ||
| Qualcomm SD429 | ||
| qualcomm SDM439 firmware | ||
| Qualcomm SDM439 Firmware | ||
| qualcomm SDM630 firmware | ||
| qualcomm SDM630 | ||
| Qualcomm SDM632 | ||
| Qualcomm SDM632 | ||
| Qualcomm SD 636 Firmware | ||
| Qualcomm SDM636 Firmware | ||
| Qualcomm SD660 Firmware | ||
| Qualcomm Snapdragon 660 | ||
| Qualcomm SDX20 Firmware | ||
| Qualcomm SDX20 Firmware | ||
| Qualcomm QCA6584 | ||
| Qualcomm QCA6584AU |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://source.android.com/docs/security/bulletin/2018-09-01/#asterisk
- https://source.android.com/docs/security/bulletin/2018-09-01 (Advisory)
- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000051618
- https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
- https://www.qualcomm.com/company/product-security/bulletins
Frequently Asked Questions
What is CVE-2018-11290?
CVE-2018-11290 is a vulnerability in Qualcomm Snapdragon devices that may allow an attacker to execute arbitrary code or gain elevated privileges.
How severe is CVE-2018-11290?
CVE-2018-11290 has a severity rating of 7.5, which is classified as high.
Which devices are affected by CVE-2018-11290?
Qualcomm Snapdragon devices including MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820A, SD 845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDX20 are affected by CVE-2018-11290.
How can an attacker exploit CVE-2018-11290?
An attacker can exploit CVE-2018-11290 by exploiting a vulnerability in Qualcomm Snapdragon devices to execute arbitrary code or gain elevated privileges.
Are there any fixes available for CVE-2018-11290?
Yes, patches and updates are available from Qualcomm and Google to address the vulnerability CVE-2018-11290.
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/google
- canonical/android
- vendor/qualcomm
- canonical/qualcomm mdm9206
- canonical/qualcomm mdm9206 firmware
- canonical/qualcomm md9607 firmware
- canonical/qualcomm mdm9607 firmware
- canonical/qualcomm mdm9640 firmware
- canonical/qualcomm mdm9640
- canonical/qualcomm mdm9650
- canonical/qualcomm mdm9650 firmware
- canonical/qualcomm msm8996au firmware
- canonical/qualcomm qca6574 firmware
- canonical/qualcomm qca6574au
- canonical/qualcomm sd 210 firmware
- canonical/qualcomm sd210 firmware
- canonical/qualcomm sd 212 firmware
- canonical/qualcomm sd 212
- canonical/qualcomm sd 205 firmware
- canonical/qualcomm snapdragon 205
- canonical/qualcomm sd425 firmware
- canonical/qualcomm snapdragon 425
- canonical/qualcomm sd427 firmware
- canonical/qualcomm sd 430 firmware
- canonical/qualcomm snapdragon 430
- canonical/qualcomm sd 435 firmware
- canonical/qualcomm snapdragon 435
- canonical/qualcomm sd 450 firmware
- canonical/qualcomm snapdragon 450
- canonical/qualcomm sd 625 firmware
- canonical/qualcomm snapdragon 625
- canonical/qualcomm sd 650 firmware
- canonical/qualcomm snapdragon 650
- canonical/qualcomm sd 652 firmware
- canonical/qualcomm sd652 firmware
- canonical/qualcomm sd 820a firmware
- canonical/qualcomm sd820a firmware
- canonical/qualcomm sd 845 firmware
- canonical/qualcomm snapdragon 845
- canonical/qualcomm sdm429w
- canonical/qualcomm sd429
- canonical/qualcomm sdm439 firmware
- canonical/qualcomm sdm630 firmware
- canonical/qualcomm sdm630
- canonical/qualcomm sdm632
- canonical/qualcomm sd 636 firmware
- canonical/qualcomm sdm636 firmware
- canonical/qualcomm sd660 firmware
- canonical/qualcomm snapdragon 660
- canonical/qualcomm sdx20 firmware
- canonical/qualcomm qca6584
- canonical/qualcomm qca6584au