PT-2019-6295 · Qualcomm · Qualcomm Snapdragon Wired Infrastructure/Networking+10

Published 2019-02-04 · Updated 2019-02-26 · CVE-2018-11938

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions IPQ8074 Qualcomm Snapdragon Compute versions MDM9150 Qualcomm Snapdragon Connectivity versions MDM9206 Qualcomm Snapdragon Consumer Electronics Connectivity versions MDM9607 Qualcomm Snapdragon Consumer IOT versions MDM9650 Qualcomm Snapdragon Industrial IOT versions MSM8909W Qualcomm Snapdragon IoT versions MSM8996AU Qualcomm Snapdragon Mobile versions QCA8081 Qualcomm Snapdragon Voice & Music versions QCS605 Qualcomm Snapdragon Wearables versions SD 210/SD 212/SD 205 Qualcomm Snapdragon Wired Infrastructure and Networking versions SD 410/12 Qualcomm Snapdragon versions SD 425 Qualcomm Snapdragon versions SD 427 Qualcomm Snapdragon versions SD 430 Qualcomm Snapdragon versions SD 435 Qualcomm Snapdragon versions SD 439 / SD 429 Qualcomm Snapdragon versions SD 450 Qualcomm Snapdragon versions SD 615/16/SD 415 Qualcomm Snapdragon versions SD 625 Qualcomm Snapdragon versions SD 632 Qualcomm Snapdragon versions SD 636 Qualcomm Snapdragon versions SD 650/52 Qualcomm Snapdragon versions SD 675 Qualcomm Snapdragon versions SD 712 / SD 710 / SD 670 Qualcomm Snapdragon versions SD 820 Qualcomm Snapdragon versions SD 820A Qualcomm Snapdragon versions SD 835 Qualcomm Snapdragon versions SD 845 / SD 850 Qualcomm Snapdragon versions SD 8CX Qualcomm Snapdragon versions SDA660 Qualcomm Snapdragon versions SDM439 Qualcomm Snapdragon versions SDM630 Qualcomm Snapdragon versions SDM660 Qualcomm Snapdragon High Med 2016 versions SXR1130

Description The issue is related to improper input validation for an argument received from HLOS, which can lead to buffer overflows and unexpected behavior. This can potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

BDU:2022-07036

CVE-2018-11938

Affected Products

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Consumer Electronics Connectivity

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

Qualcomm Snapdragon Wearables

Qualcomm Snapdragon Wired Infrastructure/Networking

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-11938 · Security Note
• https://qualcomm.com/company/product-security/bulletins · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07036 · Security Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2019-bulletin.html · Note
• https://source.android.com/docs/security/bulletin/2019-02-01 · Note
• https://bugtraq.securityfocus.com/archive · Note
• http://securityfocus.com/bid/106845 · Note