PT-2020-17662 · Qualcomm · Qualcomm Snapdragon

Published 2020-11-02 · Updated 2020-11-06 · CVE-2020-3654

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions in Agatti, APQ8053, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6390, QCA6574AU, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Description A buffer overflow occurs while processing SIP message packets due to a lack of index validation before copying into it. This issue affects various Qualcomm Snapdragon products.

Recommendations For all affected Qualcomm Snapdragon versions, apply the necessary patch or update to resolve the buffer overflow issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2020-3654

Affected Products

Qualcomm Snapdragon

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-3654 · Security Note
• https://qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin · Vendor Advisory
• https://qualcomm.com/company/product-security/bulletins/october-2020-bulletin · Note