CVE-2014-9989

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M…

published April 18, 2018

CVSS
—
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

⚠️ A misplaced endpoint number could lead to an out-of-bounds access! Imagine your USB device reaching out for a neighbor's data instead of its own—yikes! 😱 Think of the USB management module as a librarian who misreads a shelf number and wanders into a completely different section. Instead of retrieving the correct book, they accidentally open shelves they shouldn’t, potentially exposing sensitive information. If an attacker takes advantage of this flaw, they could manipulate the USB management module into accessing unintended memory locations. This could lead to data corruption or unauthorized access to sensitive data, which could have devastating consequences for users.

Put simply

Think of the USB management module as a librarian who misreads a shelf number and wanders into a completely different section. Instead of retrieving the correct book, they accidentally open shelves they shouldn’t, potentially exposing sensitive information. This vulnerability arises in Qualcomm’s USB management module found in various Snapdragon mobile platforms. When an incorrect endpoint number or direction is passed, it can cause an out-of-bounds array access, resulting in unpredictable behavior.

What to do

If an attacker takes advantage of this flaw, they could manipulate the USB management module into accessing unintended memory locations. This could lead to data corruption or unauthorized access to sensitive data, which could have devastating consequences for users. To mitigate this vulnerability, ensure that your Android device is updated to the latest security patch level released after April 5, 2018. Regularly check for and apply updates provided by your device manufacturer. 🛡️ You've got this! Stay vigilant and keep your devices updated to maintain your security hero status! 💪✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.4th percentile
Published
2018-04-18T14:00Z
EPSS history
Timeline
  • 18 APR 14:00Z
    In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M…
    cvelistv5