PT-2020-5938 · Qualcomm · Qualcomm Snapdragon Auto+6
Published
2020-02-24
·
Updated
2020-09-11
·
CVE-2020-11128
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Qualcomm Snapdragon Auto versions APQ8009 through SDM845
Qualcomm Snapdragon Compute versions APQ8009 through SDM845
Qualcomm Snapdragon Consumer IOT versions APQ8009 through SDM845
Qualcomm Snapdragon Industrial IOT versions APQ8009 through SDM845
Qualcomm Snapdragon Mobile versions APQ8009 through SDM845
Qualcomm Snapdragon Voice & Music versions APQ8009 through SDM845
Qualcomm Snapdragon Wearables versions APQ8009 through SDM845
Description:
The issue is related to a possible out of bound access while copying the mask file content into the buffer without checking the buffer size. This is due to the lack of buffer size checking during array indexing in the Diagnostic (DIAG) Mode implementation of Qualcomm's embedded software. Exploitation of this issue may allow an attacker to execute arbitrary code or cause a denial of service.
Recommendations:
For Qualcomm Snapdragon Auto versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
For Qualcomm Snapdragon Compute versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
For Qualcomm Snapdragon Consumer IOT versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
For Qualcomm Snapdragon Industrial IOT versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
For Qualcomm Snapdragon Mobile versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
For Qualcomm Snapdragon Voice & Music versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
For Qualcomm Snapdragon Wearables versions APQ8009 through SDM845, update the software to a version that includes the fix for the buffer size checking issue.
As a temporary workaround, consider disabling the Diagnostic (DIAG) Mode until a patch is available.
Fix
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Qualcomm Snapdragon Auto
Qualcomm Snapdragon Compute
Qualcomm Snapdragon Consumer Iot
Qualcomm Snapdragon Industrial Iot
Qualcomm Snapdragon Mobile
Qualcomm Snapdragon Voice & Music
Qualcomm Snapdragon Wearables