Vulnerability Name:

CVE-2015-9222 (CCN-112798)

Assigned:2016-04-28
Published:2016-04-28
Updated:2018-05-02
Summary:In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, processing erroneous bitstreams may result in a HW freeze. FW should detect the HW freeze based on watchdog timer, but because the watchdog timer is not enabled, an infinite loop occurs, resulting in a device freeze.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-399
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2015-9222

Source: BID
Type: Third Party Advisory, VDB Entry
103671

Source: CCN
Type: BID-103671
Google Android Multiple Qualcomm Components Multiple Unspecified Security Vulnerabilities

Source: XF
Type: UNKNOWN
rompager-cve20159222-sec-bypass(112798)

Source: CCN
Type: Packet Storm Security [04-27-2016]
RomPager 4.34 Authentication Bypass

Source: CONFIRM
Type: Vendor Advisory
https://source.android.com/security/bulletin/2018-04-01

Source: CCN
Type: AllegroSoft Web site
Allegro Software Development Corporation - Secure Software for the Internet of Things

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [04-27-2016]

Source: EXPLOIT-DB
Type: Third Party Advisory, VDB Entry
39739

Vulnerable Configuration:Configuration 1:
  • cpe:/o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:msm8909w:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_210:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_212:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_205:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:qualcomm:sd_400_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_400:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:qualcomm:sd_410_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_410:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:qualcomm:sd_412_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_412:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_425:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_430:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_450:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:qualcomm:sd_427_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_427:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:qualcomm:sd_435_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_435:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_625:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_650:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_652:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:qualcomm:sd_800_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_800:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:qualcomm:sd_808_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_808:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:qualcomm:sd_810_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_810:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_820:-:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_835:-:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_845:-:*:*:*:*:*:*:*

    • Configuration 22:
  • cpe:/o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm630:-:*:*:*:*:*:*:*

    • Configuration 23:
  • cpe:/o:qualcomm:sdm636_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm636:-:*:*:*:*:*:*:*

    • Configuration 24:
  • cpe:/o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm660:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:allegrosoft:rompager:4.34:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    qualcomm msm8909w firmware -
    qualcomm msm8909w -
    qualcomm sd 210 firmware -
    qualcomm sd 210 -
    qualcomm sd 212 firmware -
    qualcomm sd 212 -
    qualcomm sd 205 firmware -
    qualcomm sd 205 -
    qualcomm sd 400 firmware -
    qualcomm sd 400 -
    qualcomm sd 410 firmware -
    qualcomm sd 410 -
    qualcomm sd 412 firmware -
    qualcomm sd 412 -
    qualcomm sd 425 firmware -
    qualcomm sd 425 -
    qualcomm sd 430 firmware -
    qualcomm sd 430 -
    qualcomm sd 450 firmware -
    qualcomm sd 450 -
    qualcomm sd 427 firmware -
    qualcomm sd 427 -
    qualcomm sd 435 firmware -
    qualcomm sd 435 -
    qualcomm sd 625 firmware -
    qualcomm sd 625 -
    qualcomm sd 650 firmware -
    qualcomm sd 650 -
    qualcomm sd 652 firmware -
    qualcomm sd 652 -
    qualcomm sd 800 firmware -
    qualcomm sd 800 -
    qualcomm sd 808 firmware -
    qualcomm sd 808 -
    qualcomm sd 810 firmware -
    qualcomm sd 810 -
    qualcomm sd 820 firmware -
    qualcomm sd 820 -
    qualcomm sd 835 firmware -
    qualcomm sd 835 -
    qualcomm sd 845 firmware -
    qualcomm sd 845 -
    qualcomm sdm630 firmware -
    qualcomm sdm630 -
    qualcomm sdm636 firmware -
    qualcomm sdm636 -
    qualcomm sdm660 firmware -
    qualcomm sdm660 -
    allegrosoft rompager 4.34