CVE-2017-17772

Many functions responsible for processing 802.11 (Wi-Fi) standard frames lack proper input data validation. Insufficient buffer boundary control (CWE-125 — out-of-bounds read, CWE-126 — buffer over-read) allows reading data outside the intended memory area. Specially crafted Wi-Fi frames sent to a vulnerable device can trigger this error without any user interaction.

An attacker within wireless network range can gain unauthorized access to sensitive data stored in device memory, and in extreme cases compromise the confidentiality, integrity, and availability of the system.

Apply patches available from the vendor according to the references — Qualcomm security bulletin from May 2018: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html. OEM device manufacturers using the mentioned chipsets should deploy firmware updates for their products.

Firmware of Qualcomm SD 450, Qualcomm SD 625, and Qualcomm SD 820 chipsets — versions indicated in the vendor's references (Qualcomm security bulletin from May 2018)