PT-2020-9099 · Qualcomm · Snapdragon

Published 2020-06-22 · Updated 2021-07-21 · CVE-2019-10597

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions prior to the fixed version

Description The issue allows kernel writes to user-passed addresses without checks, leading to arbitrary memory writes in various Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, and Snapdragon Wired Infrastructure and Networking. This affects devices with IPQ6018, IPQ8074, MSM8996, MSM8996AU, Nicobar, QCS605, Rennell, Saipan, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130, and SXR2130.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-10597

Affected Products

Snapdragon

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-10597 · Security Note
• https://t.me/cibsecurity/13044 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/june-2020-bulletin · Note