PT-2019-8831 · Qualcomm · Sd 16+21

Published 2019-06-14 · Updated 2019-06-17 · CVE-2018-11939

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions (affected versions not specified)

Description The issue is related to a use after problem in the WLAN function, caused by multiple ACS scan requests at the same time. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, and Snapdragon Mobile, in specific chipsets such as MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCA6574AU, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, and SDX20.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2018-11939

Affected Products

Mdm9150

Mdm9206

Mdm9607

Mdm9640

Mdm9650

Msm8909W

Qca6574Au

Sd 16

Sd 205

Sd 210

Sd 212

Sd 415

Sd 52

Sd 615

Sd 625

Sd 650

Sd 820

Sdx20

Snapdragon Auto

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

References · 2

• https://codeaurora.org/security-bulletin/2019/05/06/may-2019-code-aurora-security-bulletin · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11939 · Security Note