PT-2019-16396 · Qualcomm · Qualcomm Snapdragon Compute+7

Published 2019-11-06 · Updated 2020-08-24 · CVE-2019-2332

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions MDM9150 through MDM9650 Qualcomm Snapdragon Compute versions QCS405 through QCS605 Qualcomm Snapdragon Consumer IOT versions SD 210/SD 212/SD 205 through SD 665 Qualcomm Snapdragon Industrial IOT versions SD 210/SD 212/SD 205 through SD 665 Qualcomm Snapdragon IoT versions SD 210/SD 212/SD 205 through SD 665 Qualcomm Snapdragon Mobile versions MSM8909W through SD 855 Qualcomm Snapdragon Voice & Music versions SD 410 through SD 660 Qualcomm Snapdragon Wearables versions SD 210/SD 212/SD 205 through SD 429

Description The issue is related to memory corruption that occurs when accessing memory without validating the payload size. This can lead to potential security risks. The estimated number of potentially affected devices is not provided.

Recommendations For Qualcomm Snapdragon Auto versions MDM9150 through MDM9650, update to a version that includes payload size validation. For Qualcomm Snapdragon Compute versions QCS405 through QCS605, apply configuration changes to restrict memory access. For Qualcomm Snapdragon Consumer IOT versions SD 210/SD 212/SD 205 through SD 665, restrict access to vulnerable modules until a patch is available. For Qualcomm Snapdragon Industrial IOT versions SD 210/SD 212/SD 205 through SD 665, consider disabling vulnerable functions to minimize risk. For Qualcomm Snapdragon IoT versions SD 210/SD 212/SD 205 through SD 665, avoid using vulnerable parameters in API endpoints. For Qualcomm Snapdragon Mobile versions MSM8909W through SD 855, update to a version with improved memory validation. For Qualcomm Snapdragon Voice & Music versions SD 410 through SD 660, apply workarounds to limit the impact of memory corruption. For Qualcomm Snapdragon Wearables versions SD 210/SD 212/SD 205 through SD 429, temporarily disable vulnerable components until a fix is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-2332

Affected Products

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

Qualcomm Snapdragon Wearables

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-2332 · Security Note
• https://source.android.com/security/bulletin · Vendor Advisory