CVE-2016-10493

CRITICAL

Qualcomm MDM9206 and related firmware - Memory Corruption via NPA RootPD Pointer Validation

Title source: llm

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, NPA routines on the rootPD that handle resource requests remoted over QDI may not validate pointers passed from user space which may result in guest OS memory corruption.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://source.android.com/security/bulletin/2018-04-01

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/103671

Scores

CVSS v3 9.8

EPSS 0.0021

EPSS Percentile 42.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (27)

qualcomm/mdm9206_firmware

qualcomm/mdm9607_firmware

qualcomm/mdm9635m_firmware

qualcomm/mdm9640_firmware

qualcomm/mdm9645_firmware

qualcomm/mdm9650_firmware

qualcomm/mdm9655_firmware

qualcomm/msm8909w_firmware

qualcomm/sd_205_firmware

qualcomm/sd_210_firmware

... and 17 more

Published Apr 18, 2018

Tracked Since Feb 18, 2026