PT-2020-9474 · Qualcomm · Sdx24+14

Published 2020-06-22 · Updated 2020-06-26 · CVE-2019-14047

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions in APQ8053, APQ8096AU, MDM9607, MSM8909W, MSM8996, MSM8996AU, QCN7605, QCS605, SC8180X, SDA845, SDX20, SDX24, SDX55, SM8150, SXR1130

Description: The issue arises when the IPA driver processes a route add rule IOCTL without validating the rule ID before adding it to the IPA HW commit list. This affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables.

Recommendations: For Qualcomm Snapdragon versions in APQ8053, APQ8096AU, MDM9607, MSM8909W, MSM8996, MSM8996AU, QCN7605, QCS605, SC8180X, SDA845, SDX20, SDX24, SDX55, SM8150, SXR1130, consider disabling the IPA driver's route add rule IOCTL processing until a patch is available. As a temporary workaround, restrict access to the IPA HW commit list to minimize the risk of exploitation. Avoid using the rule ID in the affected IPA driver until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-14047

Affected Products

Apq8053

Apq8096Au

Mdm9607

Msm8909W

Msm8996

Msm8996Au

Qcn7605

Qcs605

Sc8180X

Sda845

Sdx20

Sdx24

Sdx55

Sm8150

Sxr1130

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-14047 · Security Note
• https://qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin · Vendor Advisory
• https://qualcomm.com/company/product-security/bulletins/june-2020-bulletin · Note
• https://t.me/cibsecurity/13042 · Telegram Post