PT-2019-11889 · Qualcomm · Qualcomm Snapdragon Auto+39

Published 2019-11-06 · Updated 2019-11-07 · CVE-2019-10496

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions prior to the fixed version Qualcomm Snapdragon Compute versions prior to the fixed version Qualcomm Snapdragon Connectivity versions prior to the fixed version Qualcomm Snapdragon Consumer IOT versions prior to the fixed version Qualcomm Snapdragon Industrial IOT versions prior to the fixed version Qualcomm Snapdragon Mobile versions prior to the fixed version Qualcomm Snapdragon Voice & Music versions prior to the fixed version Qualcomm Snapdragon Wearables versions prior to the fixed version Qualcomm MSM8909W version prior to the fixed version Qualcomm MSM8996AU version prior to the fixed version Qualcomm QCS605 version prior to the fixed version Qualcomm 215 version prior to the fixed version Qualcomm SD 210/SD 212/SD 205 version prior to the fixed version Qualcomm SD 425 version prior to the fixed version Qualcomm SD 427 version prior to the fixed version Qualcomm SD 430 version prior to the fixed version Qualcomm SD 435 version prior to the fixed version Qualcomm SD 439 / SD 429 version prior to the fixed version Qualcomm SD 450 version prior to the fixed version Qualcomm SD 625 version prior to the fixed version Qualcomm SD 632 version prior to the fixed version Qualcomm SD 636 version prior to the fixed version Qualcomm SD 665 version prior to the fixed version Qualcomm SD 675 version prior to the fixed version Qualcomm SD 712 / SD 710 / SD 670 version prior to the fixed version Qualcomm SD 730 version prior to the fixed version Qualcomm SD 820 version prior to the fixed version Qualcomm SD 820A version prior to the fixed version Qualcomm SD 835 version prior to the fixed version Qualcomm SD 845 / SD 850 version prior to the fixed version Qualcomm SD 855 version prior to the fixed version Qualcomm SD 8CX version prior to the fixed version Qualcomm SDA660 version prior to the fixed version Qualcomm SDM439 version prior to the fixed version Qualcomm SDM630 version prior to the fixed version Qualcomm SDM660 version prior to the fixed version Qualcomm Snapdragon High Med 2016 version prior to the fixed version Qualcomm SXR1130 version prior to the fixed version

Description A lack of checking a variable received from a driver and populating it in the Firmware data structure leads to a buffer overflow. This issue affects various Qualcomm Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables, as well as specific chipsets such as MSM8909W, MSM8996AU, QCS605, Qualcomm 215, and several SD series chipsets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2019-10496

Affected Products

Qualcomm 215

Qualcomm Msm8909W

Qualcomm Msm8996Au

Qualcomm Qcs605

Qualcomm Sd 205

Qualcomm Sd 210

Qualcomm Sd 212

Qualcomm Sd 425

Qualcomm Sd 427

Qualcomm Sd 429

Qualcomm Sd 430

Qualcomm Sd 435

Qualcomm Sd 439

Qualcomm Sd 450

Qualcomm Sd 625

Qualcomm Sd 632

Qualcomm Sd 636

Qualcomm Sd 665

Qualcomm Sd 670

Qualcomm Sd 675

Qualcomm Sd 710

Qualcomm Sd 712

Qualcomm Sd 730

Qualcomm Sd 820A

Qualcomm Sd 835

Qualcomm Sd 845

Qualcomm Sd 850

Qualcomm Sd 855

Qualcomm Sd 8Cx

Qualcomm Sdm660

Qualcomm Sdm630

Qualcomm Sxr1130

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

Qualcomm Snapdragon Wearables

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-10496 · Security Note
• https://source.android.com/security/bulletin · Note