PT-2020-17689 · Qualcomm · Snapdragon

Published 2020-11-02 · Updated 2020-11-06 · CVE-2020-3693

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions in APQ8009, APQ8017, APQ8053, APQ8098, Bitra, MSM8909W, MSM8996AU, Nicobar, QCM2150, QCS605, Saipan, SDM429W, SDX20, SM6150, SM8150, SM8250, SXR2130

Description The issue is related to an out of range pointer problem due to an incorrect buffer range check during the execution of qseecom. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables.

Recommendations For APQ8009, consider disabling the qseecom execution until a patch is available. For APQ8017, restrict access to the vulnerable module to minimize the risk of exploitation. For APQ8053, avoid using the vulnerable buffer range check in the affected execution until the issue is resolved. For APQ8098, Bitra, MSM8909W, MSM8996AU, Nicobar, QCM2150, QCS605, Saipan, SDM429W, SDX20, SM6150, SM8150, SM8250, SXR2130, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2020-3693

Affected Products

Snapdragon

References · 5

• https://qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3693 · Security Note
• https://t.me/cvenotify/5250 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/october-2020-bulletin · Note
• https://t.me/cibsecurity/15766 · Telegram Post