cnvd - cnvd-2017-27868

cnvd-2017-27868

Vulnerability from cnvd

Title: Google Android Qualcomm组件存在未明漏洞（CNVD-2017-27868）

Description:

Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。Qualcomm是使用在其中的一个美国高通（Qualcomm）公司的设备专用的高通组件。

Google Android Qualcomm组件中存在未明漏洞，由于禁用断言导致断言中的指令不被执行，导致错误的控制流。

Severity: 高

Patch Name: Google Android Qualcomm组件存在未明漏洞（CNVD-2017-27868）的补丁

Patch Description:

Google Android Qualcomm组件中存在未明漏洞，由于禁用断言导致断言中的指令不被执行，导致错误的控制流。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://source.android.com/security/bulletin/2017-07-01

Reference: https://source.android.com/security/bulletin/2017-07-01

Impacted products

Name
Google Android

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-9971"
    }
  },
  "description": "Android\u662f\u7f8e\u56fd\u8c37\u6b4c\uff08Google\uff09\u516c\u53f8\u548c\u5f00\u653e\u624b\u6301\u8bbe\u5907\u8054\u76df\uff08\u7b80\u79f0OHA\uff09\u5171\u540c\u5f00\u53d1\u7684\u4e00\u5957\u4ee5Linux\u4e3a\u57fa\u7840\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edf\u3002Qualcomm\u662f\u4f7f\u7528\u5728\u5176\u4e2d\u7684\u4e00\u4e2a\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u8bbe\u5907\u4e13\u7528\u7684\u9ad8\u901a\u7ec4\u4ef6\u3002\r\n\r\nGoogle Android Qualcomm\u7ec4\u4ef6\u4e2d\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7981\u7528\u65ad\u8a00\u5bfc\u81f4\u65ad\u8a00\u4e2d\u7684\u6307\u4ee4\u4e0d\u88ab\u6267\u884c\uff0c\u5bfc\u81f4\u9519\u8bef\u7684\u63a7\u5236\u6d41\u3002",
  "discovererName": "Google",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://source.android.com/security/bulletin/2017-07-01",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-27868",
  "openTime": "2017-09-21",
  "patchDescription": "Android\u662f\u7f8e\u56fd\u8c37\u6b4c\uff08Google\uff09\u516c\u53f8\u548c\u5f00\u653e\u624b\u6301\u8bbe\u5907\u8054\u76df\uff08\u7b80\u79f0OHA\uff09\u5171\u540c\u5f00\u53d1\u7684\u4e00\u5957\u4ee5Linux\u4e3a\u57fa\u7840\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edf\u3002Qualcomm\u662f\u4f7f\u7528\u5728\u5176\u4e2d\u7684\u4e00\u4e2a\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u8bbe\u5907\u4e13\u7528\u7684\u9ad8\u901a\u7ec4\u4ef6\u3002\r\n\r\nGoogle Android Qualcomm\u7ec4\u4ef6\u4e2d\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7981\u7528\u65ad\u8a00\u5bfc\u81f4\u65ad\u8a00\u4e2d\u7684\u6307\u4ee4\u4e0d\u88ab\u6267\u884c\uff0c\u5bfc\u81f4\u9519\u8bef\u7684\u63a7\u5236\u6d41\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Google Android Qualcomm\u7ec4\u4ef6\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2017-27868\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Google Android"
  },
  "referenceLink": "https://source.android.com/security/bulletin/2017-07-01",
  "serverity": "\u9ad8",
  "submitTime": "2017-08-19",
  "title": "Google Android Qualcomm\u7ec4\u4ef6\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2017-27868\uff09"
}

CVE-2014-9971 (GCVE-0-2014-9971)

Vulnerability from cvelistv5

Published

2017-08-18 18:00

Modified

2024-09-16 17:39

Severity ?

CWE

Always-Incorrect Control Flow Implementation in TD-SCDMA

Summary

In all Qualcomm products with Android releases from CAF using the Linux kernel, disabling asserts causes an instruction inside of an assert to not be executed resulting in incorrect control flow.

References

▼	URL	Tags
	https://source.android.com/security/bulletin/2017-07-01	x_refsource_CONFIRM
	https://source.android.com/security/bulletin/2018-04-01	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/103671	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	Qualcomm, Inc.	Snapdragon Mobile	Version: MDM9635M, SD 835

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:02:37.381Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/2017-07-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/2018-04-01"
          },
          {
            "name": "103671",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103671"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snapdragon Mobile",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "MDM9635M, SD 835"
            }
          ]
        }
      ],
      "datePublic": "2018-04-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In all Qualcomm products with Android releases from CAF using the Linux kernel, disabling asserts causes an instruction inside of an assert to not be executed resulting in incorrect control flow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Always-Incorrect Control Flow Implementation in TD-SCDMA",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-18T13:57:01",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://source.android.com/security/bulletin/2017-07-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://source.android.com/security/bulletin/2018-04-01"
        },
        {
          "name": "103671",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103671"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@qualcomm.com",
          "DATE_PUBLIC": "2018-04-02T00:00:00",
          "ID": "CVE-2014-9971",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snapdragon Mobile",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "MDM9635M, SD 835"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Qualcomm, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In all Qualcomm products with Android releases from CAF using the Linux kernel, disabling asserts causes an instruction inside of an assert to not be executed resulting in incorrect control flow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Always-Incorrect Control Flow Implementation in TD-SCDMA"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://source.android.com/security/bulletin/2017-07-01",
              "refsource": "CONFIRM",
              "url": "https://source.android.com/security/bulletin/2017-07-01"
            },
            {
              "name": "https://source.android.com/security/bulletin/2018-04-01",
              "refsource": "CONFIRM",
              "url": "https://source.android.com/security/bulletin/2018-04-01"
            },
            {
              "name": "103671",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103671"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2014-9971",
    "datePublished": "2017-08-18T18:00:00Z",
    "dateReserved": "2017-05-30T00:00:00",
    "dateUpdated": "2024-09-16T17:39:07.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted