Qualcomm has published a newsletter that states that several of its chipsets have detected a safety fault. This is the vulnerability found in the code CVE-2018-11976 that enables a root attacker to access personal data and encryption keys. The company has already developed a solution for Android that is included in the April security patch. However, given the fragmentation of the ecosystem, many instruments are to be feared (if not forever) to be discovered for a long time. Keegan Ryan, a NCC researcher who has found out that the implementation of ECDSA cryptographical algorithms in Qualcomm allows the recovery of data in the QSEE processor, the protective area where system encryption keys are stored, raised the technical problem. The shortcoming is pertinent, and although root permissions are necessary for the attacker, it is not that difficult.
