Access to CNTVCT_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks…

published 2018-01-12 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-4735

cvss: 4.7; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

Access to CNTVCT_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks and this could lead to local information disclosure with no additional execution privileges needed in FSM9055, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA4531, QCA9980, QCN5502, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845.

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	4.7	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.7	AV:L/AC:M/Au:N/C:C/I:N/A:N

Affected products

Qualcomm, Inc. Android for MSM, Firefox OS for MSM, QRD Android

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

source.android.com /security/bulletin/2018-01-01
vendor-advisory
oracle.com /technetwork/security-advisory/cpujul2018-4258247.html
securityfocus.com /bid/102390
vdb-entry, third-party-advisory
codeaurora.org /security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin
securitytracker.com /id/1040106
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-13218
NVD CVE-2017-13218

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary