LiveActive security incident?Get immediate response
CVE Record

CVE-2017-15844: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel,...

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the function for writing device values into flash, uninitialized memory can be written to flash.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Qualcomm CAF issue could cause uninitialized memory to be written into device flash during a flash-write operation. The public bundle does not explain business impact, attacker access, or affected OEM device models, so urgency should be driven by whether your fleet uses Qualcomm CAF-based Android firmware.

Executive priority

Treat this as an inventory and vendor-follow-up item unless affected Qualcomm CAF-based firmware is confirmed. Escalate if the organization operates unsupported devices where OEM firmware fixes cannot be verified.

Technical view

CVE-2017-15844 affects Android for MSM, Firefox OS for MSM, and QRD Android releases from CAF using the Linux kernel. The flaw occurs while processing a function that writes device values into flash, allowing uninitialized memory to be written. No CVSS, CWE, privilege requirement, or detailed impact is provided.

Likely exposure

Exposure is most likely in Qualcomm CAF-derived firmware for affected Android for MSM, Firefox OS for MSM, or QRD Android builds. The bundle does not identify specific devices, OEMs, branches, or kernel versions.

Exploitation context

The CVE is not marked as CISA KEV, and the provided sources do not claim active exploitation or publish exploit details. Attacker position, required privileges, and practical exploitability are not stated.

Researcher notes

The public record is sparse: no CVSS, CWE, exploitability detail, or device mapping is included. Analysis should focus on tracing CAF kernel lineage, reviewing the referenced CodeAurora commit, and confirming OEM backports without assuming broader Android exposure.

Mitigation direction

  • Check Qualcomm or OEM guidance tied to the September 2018 Code Aurora bulletin.
  • Inventory devices and firmware that use affected CAF Linux kernel releases.
  • Apply OEM firmware updates where they explicitly address this CVE.
  • Restrict service or administrative paths that can trigger flash value writes.
  • Track unsupported devices separately for replacement or compensating controls.

Validation and detection

  • Confirm whether device firmware is derived from Qualcomm CAF affected releases.
  • Check OEM security bulletins for CVE-2017-15844 remediation status.
  • Verify deployed firmware versions against vendor-fixed builds.
  • Review asset inventory for Android for MSM, Firefox OS for MSM, or QRD Android usage.
  • Document unknown firmware provenance as unresolved exposure.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-15844 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Qualcomm, Inc.Android for MSM, Firefox OS for MSM, QRD AndroidAll Android releases from CAF using the Linux kernelListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.