CVE-2018-3591

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD…

published April 11, 2018

CVSS
—
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

⚠️ A default setting could turn your phone into an open book! This vulnerability in Qualcomm's Snapdragon devices allows peek and poke commands to any memory location—no security checks required! 🔥 Think of it like a restaurant kitchen where the chef left the door wide open. Anyone can stroll in and see (or even tamper with) the entire ingredient inventory without any ID check! An attacker could gain access to sensitive data or alter critical system functions without raising any alarms. This means your personal information, passwords, or even the integrity of the entire device could be compromised with ease. Absolutely devastating if exploited!

Put simply

Think of it like a restaurant kitchen where the chef left the door wide open. Anyone can stroll in and see (or even tamper with) the entire ingredient inventory without any ID check! This vulnerability allows unauthorized access to any memory location due to a default configuration enabling dangerous peek and poke commands. Specifically, the SKIP_SECBOOT_CHECK_NOT_RECOMMENDED_BY_QUALCOMM flag is enabled, bypassing essential security checks.

What to do

An attacker could gain access to sensitive data or alter critical system functions without raising any alarms. This means your personal information, passwords, or even the integrity of the entire device could be compromised with ease. Absolutely devastating if exploited! To mitigate this risk, ensure that your device firmware is updated to the latest security patch level—specifically, after April 5, 2018. Additionally, consider disabling developer options and unnecessary debugging features if they're enabled. Regularly check for updates from your device manufacturer! You've got this! With a simple update, you can lock down your device and keep your data safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.4th percentile
Published
2018-04-11T15:00Z
EPSS history
Timeline
  • 11 APR 15:00Z
    In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD…
    cvelistv5