PT-2019-11903 · Qualcomm · Snapdragon

Published 2019-09-30 · Updated 2019-10-02 · CVE-2019-10510

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions (affected versions not specified)

Description The issue occurs due to a null pointer dereference when an invalid vendor pass through command is sent from a remote source, causing the BT process to die and BT to toggle. This affects various Snapdragon products, including Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, and Snapdragon Voice & Music, in several chipsets such as QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, and SDM660.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-10510

Affected Products

Snapdragon

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-10510 · Security Note
• https://codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin · Patch