PT-2019-8823 · Qualcomm · Qualcomm Snapdragon Auto+35

Published 2019-05-24 · Updated 2019-05-29 · CVE-2018-11930

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions (affected versions not specified) Qualcomm Snapdragon Compute versions (affected versions not specified) Qualcomm Snapdragon Consumer IOT versions (affected versions not specified) Qualcomm Snapdragon Industrial IOT versions (affected versions not specified) Qualcomm Snapdragon Mobile versions (affected versions not specified) MDM9150 (affected versions not specified) MDM9206 (affected versions not specified) MDM9607 (affected versions not specified) MDM9640 (affected versions not specified) MDM9650 (affected versions not specified) MSM8996AU (affected versions not specified) QCS605 (affected versions not specified) Qualcomm 215 (affected versions not specified) SD 425 (affected versions not specified) SD 427 (affected versions not specified) SD 430 (affected versions not specified) SD 435 (affected versions not specified) SD 439 / SD 429 (affected versions not specified) SD 450 (affected versions not specified) SD 625 (affected versions not specified) SD 632 (affected versions not specified) SD 636 (affected versions not specified) SD 675 (affected versions not specified) SD 820A (affected versions not specified) SD 835 (affected versions not specified) SD 845 / SD 850 (affected versions not specified) SD 855 (affected versions not specified) SDA660 (affected versions not specified) SDM439 (affected versions not specified) SDM630 (affected versions not specified) SDM660 (affected versions not specified) SDX20 (affected versions not specified) SDX24 (affected versions not specified) SM7150 (affected versions not specified)

Description The issue arises from improper input validation on input data used to locate and copy additional IEs in the WLAN function, potentially leading to an integer truncation issue. This affects various Qualcomm Snapdragon and related products.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2018-11930

Affected Products

Mdm9150

Mdm9206

Mdm9607

Mdm9640

Mdm9650

Msm8996Au

Qcs605

Qualcomm 215

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon Mobile

Sd 425

Sd 427

Sd 429

Sd 430

Sd 435

Sd 439

Sd 450

Sd 625

Sd 632

Sd 636

Sd 675

Sd 820A

Sd 835

Sd 845

Sd 850

Sd 855

Sda660

Sdm439

Sdm630

Sdm660

Sdx20

Sdx24

Sm7150

References · 2

• https://codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11930 · Security Note