• Home
  • Mobiles
  • Mobiles News
  • 'QualPwn' Critical Security Flaws Affecting Android Phones With Qualcomm Processors Discovered, Patched

'QualPwn' Critical Security Flaws Affecting Android Phones With Qualcomm Processors Discovered, Patched

The vulnerabilities have been patched by Qualcomm, but phone manufacturers have to release updates

'QualPwn' Critical Security Flaws Affecting Android Phones With Qualcomm Processors Discovered, Patched
Highlights
  • An attacker would need to be on the same Wi-Fi network as the target
  • Qualcomm has released updates through Google and hardware OEMs
  • All Android users are advised to download the August 2019 security patch
Advertisement

The Android Open Source Project (AOSP) website has published its Security Bulletin for August 2019, in which details of two high-severity issues affecting Android devices powered by Qualcomm processors are described. The two security flaws, together known as 'QualPwn', have been patched in the August 2019 over-the-air Android security update. At least one of the two issues affects Qualcomm's Wi-Fi and cellular hardware in a number of popular current and retired smartphone SoC models including the Snapdragon 855, 845, 835, 820, 730, 712, 710, 675, 670, 665, and 636. The Snapdragon 850 and 8CX which are designed for laptops, and several other special-purpose processors aimed at the automotive, IoT, and smart speaker segments, are also affected. 

The issues have been publicised by Tencent Blade, the security arm of Chinese gaming company Tencent. As reported by ZDNet, these flaws can be exploited over the air and do not require hands-on access to a target device, but they do need proximity since an attacker would need to be using the same Wi-Fi network. 

By sending a maliciously modified data packet to the target device, over either a Wi-Fi or cellular connection, the attacker could use these two flaws to create a chain of events that can compromise the device's Android kernel. No action would be required on the part of the device user. On its own, the first flaw could still allow an attacker to spy on a device's communications. 

Qualcomm says it has already released a patch to its partners which they can distribute in future software updates, though many of these manufacturers do not release regular software updates for their phones, especially older models. The August 2019 Android security patch also includes a fix.

Tencent Blade says it has verified the flaw using a Google Pixel 3 (Review) and a Google Pixel 2 (Review), which use the Snapdragon 845 and Snapdragon 835 processors respectively, but has not tried other devices. The company's researchers will present more information beginning this week at the Black Hat and Defcon security conferences. No evidence of these flaws actually being exploited in the wild has been presented.

The flaws were first uncovered in February, after Tencent Blade informed Google, which then roped  Qualcomm in. Qualcomm issued its patch to OEMs in early June. Tencent Blade is only now disclosing this information because enough time has passed for the update to make its way into the August 2019 Android patch.  

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Nokia 6.2, Nokia 7.2 Said to Receive Certification in Indonesia, Launch Appears Imminent
NASA's Mars 2020 Rover Undergoes 'Eye' Test
Share on Facebook Gadgets360 Twitter Share Tweet Snapchat Share Reddit Comment google-newsGoogle News
 
 

Advertisement

Follow Us

Advertisement

© Copyright Red Pixels Ventures Limited 2024. All rights reserved.
Trending Products »
Latest Tech News »