CVE-2017-18305 : What You Need to Know

Snapdragon Mobile and Snapdragon Wear devices by Qualcomm are affected by a vulnerability that allows unauthorized access to EL3 through the XBL sec mem dump system call.

Understanding CVE-2017-18305

This CVE entry details an improper access control issue in Qualcomm's Snapdragon Mobile and Snapdragon Wear devices.

What is CVE-2017-18305?

The vulnerability in Snapdragon Mobile and Snapdragon Wear devices enables full control of EL3 by unlocking all XPUs when the enable fuse is not blown.

The Impact of CVE-2017-18305

The vulnerability allows unauthorized access to EL3, potentially leading to security breaches and unauthorized system control.

Technical Details of CVE-2017-18305

Qualcomm's Snapdragon Mobile and Snapdragon Wear devices are affected by this vulnerability.

Vulnerability Description

The XBL sec mem dump system call in affected Qualcomm devices provides complete control of EL3 by unlocking all XPUs when the enable fuse is not blown.

Affected Systems and Versions

Products: Snapdragon Mobile, Snapdragon Wear
Versions: MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835

Exploitation Mechanism

Unauthorized users can exploit this vulnerability to gain full control of EL3 by bypassing the enable fuse.

Mitigation and Prevention

To address CVE-2017-18305, follow these steps:

Immediate Steps to Take

Apply patches provided by Qualcomm promptly.
Monitor Qualcomm's security bulletins for updates.

Long-Term Security Practices

Regularly update firmware and software on affected devices.
Implement access controls and restrictions to prevent unauthorized system access.

Patching and Updates

Stay informed about security advisories from Qualcomm.
Apply recommended patches and updates to mitigate the vulnerability.