PT-2020-12597 · Qualcomm · Qualcomm Snapdragon

Published 2020-11-12 · Updated 2022-10-19 · CVE-2020-11208

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439

Description The issue is related to an out of bounds problem in DSP services. This occurs while processing received arguments due to improper validation of the length received as an argument.

Recommendations For Qualcomm Snapdragon versions SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439, consider implementing proper validation of the length of received arguments in DSP services to prevent out of bounds issues. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2020-11208

Affected Products

Qualcomm Snapdragon

References · 4

• 🔥 https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11208 · Security Note
• https://qualcomm.com/company/product-security/bulletins/november-2020-bulletin · Vendor Advisory
• https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril · Note