PT-2020-12586 · Qualcomm · Snapdragon Connectivity+8

Published 2020-11-02 · Updated 2020-11-06 · CVE-2020-11174

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Snapdragon Auto versions Agatti through SM8250 Snapdragon Compute versions APQ8009 through SDX55 Snapdragon Connectivity versions IPQ4019 through QCS605 Snapdragon Consumer IOT versions QCA6390 through SA8155P Snapdragon Industrial IOT versions QCA9531 through SC8180X Snapdragon Mobile versions MSM8905 through SDM845 Snapdragon Voice & Music versions QCM2150 through SXR2130 Snapdragon Wearables versions SA415M through SDM670 Snapdragon Wired Infrastructure and Networking versions Bitra through SM6150

Description The issue is an array index underflow in the adsp driver due to an improper check of the channel id before it is used as an array index. This affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables, and Wired Infrastructure and Networking.

Recommendations For Snapdragon Auto versions Agatti through SM8250, update the adsp driver to a version that properly checks the channel id before using it as an array index. For Snapdragon Compute versions APQ8009 through SDX55, restrict access to the adsp driver until a patch is available. For Snapdragon Connectivity versions IPQ4019 through QCS605, consider disabling the adsp driver as a temporary workaround until a fix is released. For Snapdragon Consumer IOT versions QCA6390 through SA8155P, apply configuration changes to minimize the risk of exploitation. For Snapdragon Industrial IOT versions QCA9531 through SC8180X, avoid using the vulnerable adsp driver until the issue is resolved. For Snapdragon Mobile versions MSM8905 through SDM845, update to a newer version that includes the fix for the array index underflow issue. For Snapdragon Voice & Music versions QCM2150 through SXR2130, restrict the use of the adsp driver to prevent potential exploitation. For Snapdragon Wearables versions SA415M through SDM670, update the adsp driver to a version that includes the fix for the array index underflow issue. For Snapdragon Wired Infrastructure and Networking versions Bitra through SM6150, apply the recommended patch to resolve the issue.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2020-11174

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

Snapdragon Wired Infrastructure/Networking

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-11174 · Security Note
• https://qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin · Vendor Advisory
• https://t.me/cibsecurity/15765 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/october-2020-bulletin · Note