PT-2020-9069 · Qualcomm · Snapdragon Wearables+5

Published 2020-03-05 · Updated 2020-03-07 · CVE-2019-10549

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions MSM8905 through SM8150

Description A null pointer dereference issue can occur due to improper validation of the CSEQ header response received from the network. This issue affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, and Snapdragon Wearables.

Recommendations For versions MSM8905 through SM8150, consider disabling the reception of CSEQ header responses from the network as a temporary workaround until a patch is available. Restrict access to the vulnerable network reception module to minimize the risk of exploitation. Avoid using the CSEQ header in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-10549

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Wearables

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-10549 · Security Note
• https://qualcomm.com/company/product-security/bulletins/march-2020-bulletin · Vendor Advisory
• https://t.me/cibsecurity/10309 · Telegram Post