CVE-2018-13906: Input Validation
The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forged application message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, SnapdragonHighMed2016, SXR1130
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13906?
CVE-2018-13906 has been classified with high severity due to the potential for forged application messages.
How do I fix CVE-2018-13906?
To fix CVE-2018-13906, users should apply recommended security patches from their device manufacturers.
What systems are affected by CVE-2018-13906?
CVE-2018-13906 affects certain Qualcomm chipsets and devices running on Snapdragon platforms.
Can CVE-2018-13906 lead to data breaches?
Yes, CVE-2018-13906 can potentially lead to data breaches if exploited by attackers.
Is my device at risk from CVE-2018-13906?
Devices using vulnerable Qualcomm chipsets are at risk from CVE-2018-13906 if not updated.