PT-2020-17685 · Qualcomm · Sda660+52

Published

2020-11-02

·

Updated

2020-11-06

·

CVE-2020-3684

CVSS v2.0

4.6

Medium

VectorAV:L/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Snapdragon Auto (affected versions not specified) Snapdragon Compute (affected versions not specified) Snapdragon Connectivity (affected versions not specified) Snapdragon Consumer IOT (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon Mobile (affected versions not specified) Snapdragon Voice & Music (affected versions not specified) Snapdragon Wired Infrastructure and Networking (affected versions not specified) Agatti (affected versions not specified) APQ8009 (affected versions not specified) APQ8098 (affected versions not specified) Bitra (affected versions not specified) IPQ6018 (affected versions not specified) Kamorta (affected versions not specified) MDM9150 (affected versions not specified) MDM9205 (affected versions not specified) MDM9206 (affected versions not specified) MDM9607 (affected versions not specified) MDM9650 (affected versions not specified) MSM8905 (affected versions not specified) MSM8998 (affected versions not specified) Nicobar (affected versions not specified) QCA6390 (affected versions not specified) QCS404 (affected versions not specified) QCS405 (affected versions not specified) QCS605 (affected versions not specified) QCS610 (affected versions not specified) Rennell (affected versions not specified) SA415M (affected versions not specified) SA515M (affected versions not specified) SA6155P (affected versions not specified) SA8155P (affected versions not specified) Saipan (affected versions not specified) SC7180 (affected versions not specified) SC8180X (affected versions not specified) SDA660 (affected versions not specified) SDA845 (affected versions not specified) SDM630 (affected versions not specified) SDM636 (affected versions not specified) SDM660 (affected versions not specified) SDM670 (affected versions not specified) SDM710 (affected versions not specified) SDM845 (affected versions not specified) SDM850 (affected versions not specified) SDX20 (affected versions not specified) SDX24 (affected versions not specified) SDX55 (affected versions not specified) SM6150 (affected versions not specified) SM7150 (affected versions not specified) SM8150 (affected versions not specified) SM8250 (affected versions not specified) SXR1130 (affected versions not specified) SXR2130 (affected versions not specified)
Description QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them without validation. This issue affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wired Infrastructure and Networking, as well as multiple specific chipsets.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2020-3684

Affected Products

Apq8009
Apq8098
Agatti
Bitra
Ipq6018
Kamorta
Mdm9150
Mdm9205
Mdm9206
Mdm9607
Mdm9650
Msm8905
Msm8998
Nicobar
Qca6390
Qcs404
Qcs405
Qcs605
Qcs610
Rennell
Sa415M
Sa515M
Sa6155P
Sa8155P
Sc7180
Sc8180X
Sda660
Sda845
Sdm630
Sdm636
Sdm660
Sdm670
Sdm710
Sdm845
Sdm850
Sdx20
Sdx24
Sdx55
Sm6150
Sm7150
Sm8150
Sm8250
Sxr1130
Sxr2130
Saipan
Snapdragon Auto
Snapdragon Compute
Snapdragon Connectivity
Snapdragon Consumer Iot
Snapdragon Industrial Iot
Snapdragon Mobile
Snapdragon Voice & Music
Snapdragon Wired Infrastructure/Networking