PT-2020-9115 · Qualcomm · Qualcomm Snapdragon

Published 2020-04-16 · Updated 2020-08-24 · CVE-2019-10623

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions (affected versions not specified)

Description The issue is related to a possible integer overflow in the host driver when processing a user-controlled string due to improper validation of received data. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, and Snapdragon Mobile, in specific chipsets such as QCN7605, QCS605, Rennell, SC8180X, SDA845, SDM710, SDX24, SDX55, SM7150, SM8150, SM8250, and SXR2130.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2019-10623

Affected Products

Qualcomm Snapdragon

References · 3

• https://qualcomm.com/company/product-security/bulletins/april-2020-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10623 · Security Note
• https://t.me/cibsecurity/11330 · Telegram Post