CVE-2016-10467
Estado: ModificadaCrítica (9.8)—
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, function ce_pkcs1_pss_padding_verify_auto_recover_saltlen assumes that the size of the encoded message is equal to the size of the RSA modulus. This assumption is true for most RSA keys, but it fails when modulus_bitlen % 8 == 1.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.19%
- Percentil entre todas las CVEs puntuadas: 67
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (16)
Qualcomm — SD 205 FirmwareQualcomm — SD 210 FirmwareQualcomm — SD 212 FirmwareQualcomm — SD 400 FirmwareQualcomm — SD 410 FirmwareQualcomm — SD 412 FirmwareQualcomm — SD 415 FirmwareQualcomm — SD 615 FirmwareQualcomm — SD 616 FirmwareQualcomm — SD 617 FirmwareQualcomm — SD 650 FirmwareQualcomm — SD 652 FirmwareQualcomm — SD 800 FirmwareQualcomm — SD 808 FirmwareQualcomm — SD 820 FirmwareQualcomm — SD 820a Firmware
CWE
- CWE-320
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-10467",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": true,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "product-security@qualcomm.com",
"affectedData": [
{
"vendor": "Qualcomm, Inc.",
"product": "Snapdragon Automobile, Snapdragon Mobile",
"versions": [
{
"status": "affected",
"version": "SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 820, SD 820A"
}
]
}
]
}
],
"published": "2018-04-18T14:29:12.717",
"references": [
{
"url": "http://www.securityfocus.com/bid/103671",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "product-security@qualcomm.com"
},
{
"url": "https://source.android.com/security/bulletin/2018-04-01",
"tags": [
"Vendor Advisory"
],
"source": "product-security@qualcomm.com"
},
{
"url": "http://www.securityfocus.com/bid/103671",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://source.android.com/security/bulletin/2018-04-01",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-320"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, function ce_pkcs1_pss_padding_verify_auto_recover_saltlen assumes that the size of the encoded message is equal to the size of the RSA modulus. This assumption is true for most RSA keys, but it fails when modulus_bitlen % 8 == 1."
},
{
"lang": "es",
"value": "En Android antes del nivel de parcheo de seguridad del 2018-04-05 o antes en Qualcomm Snapdragon Automobile y Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 820 y SD 820A, la función ce_pkcs1_pss_padding_verify_auto_recover_saltlen asume que el tamaño del mensaje cifrado es igual al tamaño del modulus RSA. Esa asunción es cierta para la mayoría de claves RSA, pero fracasa cuando modulus_bitlen % 8 == 1."
}
],
"lastModified": "2026-06-17T00:39:44.390",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FA80D57-3191-47CF-AD3F-9F2D64E443FE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_210:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B2AFB212-F01A-4CEB-8DB4-2E0CC2308CB6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0986EF1-0974-488E-84C4-6880F876CE55"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_212:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8C08BA58-2EBC-4A22-85A4-2ECD54693B9B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27110478-4C08-49E6-BD53-8BAAD9D5BD65"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_205:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3664D302-D22A-4B25-B534-3097AE2F8573"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_400_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC3C20F8-9EFD-457C-B0B2-DA3C44A8B26D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4B562043-7A0C-4692-A94F-EF4086BAA654"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_410_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F683C42D-A310-4369-9689-3DBC9288591E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_410:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0EADE10A-0F63-4149-8F03-030673D6D7CE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_412_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A78C9449-5EB0-459B-AA72-EFF00592C30A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_412:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2D583172-F1F1-4DF8-99CE-B94A84D14CCD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_615_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "549E6F7E-A54F-423F-BD4A-A8FB97DBD39E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_615:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "992C3835-7183-4D96-8647-DD9916880323"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_616_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7B95CCC-37F1-4768-8D64-CA2028E93E03"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_616:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D1426161-4F7C-44B1-AA9E-EA661AA68947"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_415_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ECF81213-DE2D-4C4B-99E8-71AFD87E92CD"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_415:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "95E826EF-343B-47FA-AB54-F13E868CE6A7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_617_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D27A1760-8D1B-4172-B6CE-65C72332F103"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_617:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CC5F96F1-D3FB-482B-A3C8-57BA4DE86D5E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC1650DB-FDF8-4BE5-9437-8ADA11A07116"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_650:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B51DD51F-4BDE-497B-89E5-551D10CF3442"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0752054B-2C29-4490-ADC8-29F82BAA17E6"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_652:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "005038B5-BCB7-4A23-8562-ACEF6E156C1F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_800_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67E0DD11-0B28-4B6D-BDB7-0DBFA34A7187"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "551512D0-ED24-4B5A-BEB2-B090BB8DEE0C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_808_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33257838-2D70-4C43-8EE8-7538764EFFD9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_808:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1B2D83E1-F1F2-48E5-B3E0-806DAB14B60B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E08016A2-E4FE-4E9C-A915-C66BE157AFB5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_820a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "018452D0-007C-4740-B2AF-E5C8BBAC310F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E077FC03-F86F-417A-A3E6-BC88CB85C6F0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:qualcomm:sd_820:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E016356C-94ED-4CDD-8351-97D265FE036E"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "product-security@qualcomm.com"
}