PT-2020-17681 · Qualcomm · Qualcomm Snapdragon

Published 2020-11-02 · Updated 2020-11-06 · CVE-2020-3678

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130

Description A buffer overflow could occur due to improper use of the API, as the UIE init does not contain a buffer size parameter. This issue affects various Qualcomm Snapdragon products, including Consumer IOT, Industrial IOT, Mobile, and Wired Infrastructure and Networking.

Recommendations For Qualcomm Snapdragon versions in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130, consider restricting access to the API until a proper fix is implemented to prevent buffer overflow. As a temporary workaround, consider implementing buffer size validation for the UIE init parameter to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-3678

Affected Products

Qualcomm Snapdragon

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3678 · Security Note
• https://qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin · Vendor Advisory
• https://t.me/cvenotify/5260 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/october-2020-bulletin · Note