CVE-2017-13218

Severity: medium (CVSS 4.7 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-12 · updated 2026-06-17
Weakness: CWE-200

Description

Access to CNTVCT_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks and this could lead to local information disclosure with no additional execution privileges needed in FSM9055, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA4531, QCA9980, QCN5502, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845.

Affected products

Android: all versions

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/102390
http://www.securitytracker.com/id/1040106
https://source.android.com/security/bulletin/2018-01-01
https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/102390
http://www.securitytracker.com/id/1040106
https://source.android.com/security/bulletin/2018-01-01
https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin

Get alerted when CVE-2017-13218 or the next vulnerability affects your stack