CVE-2016-10434
Last modified
CVE-2016-10434 is a vulnerability of currently unknown severity. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using HMAC) and then processed. However, some of the processing occurs before the buffer is authenticated. EPSS estimates a 0.84% chance of exploitation in the next 30 days.
Description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using HMAC) and then processed. However, some of the processing occurs before the buffer is authenticated. The function will return various types of errors depending on the values of the `response` and `result` fields of the buffer before verifying the HMAC tag.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Sd 820 Firmware | All versions |
| Qualcomm | Sd 820a Firmware | All versions |
References
- http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
- https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
- http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
- https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-10434?
How severe is CVE-2016-10434?
How do I fix CVE-2016-10434?
Are you affected by CVE-2016-10434?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST