PT-2019-11887 · Qualcomm · Snapdragon

Published 2019-12-12 · Updated 2021-07-21 · CVE-2019-10494

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150

Description A race condition exists between camera functions due to a lack of resource lock, leading to memory corruption and Use After Free (UAF) issues. This issue affects various Qualcomm Snapdragon products, including those used in automotive, consumer electronics, industrial IoT, mobile, voice and music, and wearables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Memory Corruption

Time Of Check To Time Of Use

Use After Free

Weakness Enumeration

CWE-667

CWE-787

CWE-367

CWE-416

Related Identifiers

CVE-2019-10494

Affected Products

Snapdragon

References · 2

• https://qualcomm.com/company/product-security/bulletins/november-2019-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10494 · Security Note