PT-2020-12581 · Qualcomm · Snapdragon Connectivity+6

Published 2020-11-02 · Updated 2020-11-09 · CVE-2020-11164

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions in Agatti, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8909W, MSM8917, MSM8940, Nicobar, QCA6390, QCM2150, QCS605, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429W, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Description The issue is related to improper access control in Perfdump, which may allow third-party apps to call broadcasts and cause a privilege escalation issue. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, and Snapdragon Wearables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-11164

Affected Products

Perfdump

Snapdragon Auto

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Wearables

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-11164 · Security Note
• https://qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin · Vendor Advisory
• https://t.me/cvenotify/5379 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/october-2020-bulletin · Note