PT-2020-9079 · Qualcomm · Sdm439+21

Published 2020-03-05 · Updated 2020-03-09 · CVE-2019-10569

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions prior to the fixed version (affected versions not specified)

Description A stack buffer overflow occurs due to the instance id being misplaced inside the definition of hardware accelerated effects in a makefile. This issue affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, and Snapdragon Mobile, in multiple chipsets such as APQ8053, APQ8098, MDM9607, MDM9640, MSM8998, QCS605, SC8180X, SDM439, SDM630, SDM636, SDM660, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, and SXR1130.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-10569

Affected Products

Apq8053

Apq8098

Mdm9607

Mdm9640

Msm8998

Qcs605

Sc8180X

Sdm439

Sdm630

Sdm636

Sdm660

Sdm845

Sdx24

Sdx55

Sm6150

Sm7150

Sm8150

Sxr1130

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Mobile

References · 3

• https://qualcomm.com/company/product-security/bulletins/march-2020-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10569 · Security Note
• https://t.me/cibsecurity/10304 · Telegram Post