CVE-2016-10467
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, function ce_pkcs1_pss_padding_verify_auto_recover_saltlen assumes that the size of the encoded message is equal to the size of the RSA modulus. This assumption is true for most RSA keys, but it fails when modulus_bitlen % 8 == 1.
- Score
- CVSS 3.0 9.8 Critical
- Status
- Modified - product-security@qualcomm.com
- Published
- 2018-04-18
- Last modified
- 2024-09-17
- Weaknesses
- CWE-320
Affected products
- Sd 205 Firmware (Qualcomm)
- Sd 210 Firmware (Qualcomm)
- Sd 212 Firmware (Qualcomm)
- Sd 400 Firmware (Qualcomm)
- Sd 410 Firmware (Qualcomm)
- Sd 412 Firmware (Qualcomm)
- Sd 415 Firmware (Qualcomm)
- Sd 615 Firmware (Qualcomm)
- Sd 616 Firmware (Qualcomm)
- Sd 617 Firmware (Qualcomm)
- Sd 650 Firmware (Qualcomm)
- Sd 652 Firmware (Qualcomm)
- Sd 800 Firmware (Qualcomm)
- Sd 808 Firmware (Qualcomm)
- Sd 820 Firmware (Qualcomm)
- Sd 820a Firmware (Qualcomm)
- Snapdragon Automobile (Qualcomm Inc.)
- Snapdragon Mobile (Qualcomm Inc.)
References
- http://www.securityfocus.com/bid/103671
- https://source.android.com/security/bulletin/2018-04-01
