PT-2020-17566 · Qualcomm · Qualcomm Snapdragon

Published 2020-06-22 · Updated 2020-06-25 · CVE-2020-3614

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions APQ8009 through APQ8098 Qualcomm Snapdragon versions IPQ6018 through IPQ8074 Qualcomm Snapdragon versions MDM9206 through MDM9650 Qualcomm Snapdragon versions MSM8905 through MSM8998 Qualcomm Snapdragon versions QCA6174A through QCA9886 Qualcomm Snapdragon versions QCM2150 through QCS605 Qualcomm Snapdragon versions QM215 through SXR1130 Qualcomm Snapdragon versions SC7180 through SDM845 Qualcomm Snapdragon versions SDX20 through SM8150

Description A possible buffer overflow occurs while copying a frame to a local buffer due to a lack of length check before copying. This issue affects various Qualcomm Snapdragon products, including Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, Wearables, and Wired Infrastructure and Networking.

Recommendations For Qualcomm Snapdragon versions APQ8009 through APQ8098, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions IPQ6018 through IPQ8074, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions MDM9206 through MDM9650, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions MSM8905 through MSM8998, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions QCA6174A through QCA9886, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions QCM2150 through QCS605, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions QM215 through SXR1130, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions SC7180 through SDM845, update to a version that includes the fix for this issue. For Qualcomm Snapdragon versions SDX20 through SM8150, update to a version that includes the fix for this issue. As a temporary workaround, consider implementing additional checks for buffer length before copying frames to local buffers.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-3614

Affected Products

Qualcomm Snapdragon

References · 4

• https://qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3614 · Security Note
• https://t.me/cvenotify/4552 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/june-2020-bulletin · Note