In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, if WLAN FW receives the WMI_STA_SMPS_PARAM_CMDID ioctl in not-associated state, when the virtual channel handle is not assigned, the code doesn't check for NULL virtual channel handle, so an assert occurs.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HQualcomm Mdm9607
HWQualcommall versionsQualcomm Mdm9607 Firmware
OSQualcommall versionsQualcomm Mdm9635m
HWQualcommall versionsQualcomm Mdm9635m Firmware
OSQualcommall versionsQualcomm Mdm9640
HWQualcommall versionsQualcomm Mdm9640 Firmware
OSQualcommall versionsQualcomm Mdm9650
HWQualcommall versionsQualcomm Mdm9650 Firmware
OSQualcommall versionsQualcomm Qca4531
HWQualcommall versionsQualcomm Qca4531 Firmware
OSQualcommall versionsQualcomm Qca6174a
HWQualcommall versionsQualcomm Qca6174a Firmware
OSQualcommall versionsQualcomm Qca6574au
HWQualcommall versionsQualcomm Qca6574au Firmware
OSQualcommall versionsQualcomm Qca6584
HWQualcommall versionsQualcomm Qca6584au
HWQualcommall versionsQualcomm Qca6584au Firmware
OSQualcommall versionsQualcomm Qca6584 Firmware
OSQualcommall versionsQualcomm Qca9377
HWQualcommall versionsQualcomm Qca9377 Firmware
OSQualcommall versionsQualcomm Qca9378
HWQualcommall versionsQualcomm Qca9378 Firmware
OSQualcommall versionsQualcomm Qca9379
HWQualcommall versionsQualcomm Qca9379 Firmware
OSQualcommall versionsQualcomm Sd 205
HWQualcommall versionsQualcomm Sd 205 Firmware
OSQualcommall versionsQualcomm Sd 210
HWQualcommall versionsQualcomm Sd 210 Firmware
OSQualcommall versionsQualcomm Sd 212
HWQualcommall versionsQualcomm Sd 212 Firmware
OSQualcommall versions
Related vulnerabilities
Memory corruption w Qualcomm podczas składania pakietów RTP (NALUs)
Qualcomm Firmware — memory corruption przy wyborze PLMN z listy SOR
Qualcomm: podatność kryptograficzna umożliwiająca Auth Bypass podczas pobierania
Qualcomm: Uszkodzenie pamięci przy parsowaniu ML IE w firmware
Qualcomm SD 450/625/820 — odczyt poza granicami bufora w obsłudze ramek 802.11