PT-2020-9077 · Qualcomm · Qualcomm Snapdragon

Dex + 1 · Published 2020-01-21 · Updated 2020-01-23 · CVE-2019-10561

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions APQ8009 through SDM660

Description The issue is caused by improper initialization of local variables that are parameters to the sfs api, which may lead to invalid pointer dereference and denial of service. This affects various Qualcomm Snapdragon products, including Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, Wearables, and Wired Infrastructure and Networking.

Recommendations For Qualcomm Snapdragon versions APQ8009 through SDM660, consider disabling the sfs api until a patch is available to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-10561

Affected Products

Qualcomm Snapdragon

References · 4

• https://qualcomm.com/company/product-security/bulletins/january-2020-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10561 · Security Note
• https://t.me/cibsecurity/9293 · Telegram Post
• https://t.me/cvenotify/352 · Telegram Post