PT-2020-9483 · Qualcomm · Sda660+35

Published 2020-09-08 · Updated 2020-09-11 · CVE-2019-14056

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto (affected versions not specified) Snapdragon Compute (affected versions not specified) Snapdragon Consumer IOT (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon Mobile (affected versions not specified) Snapdragon Voice & Music (affected versions not specified) Snapdragon Wired Infrastructure and Networking (affected versions not specified) Kamorta (affected versions not specified) MDM9150 (affected versions not specified) MDM9205 (affected versions not specified) MDM9607 (affected versions not specified) MDM9650 (affected versions not specified) Nicobar (affected versions not specified) QCS404 (affected versions not specified) QCS405 (affected versions not specified) QCS605 (affected versions not specified) QCS610 (affected versions not specified) Rennell (affected versions not specified) SA6155P (affected versions not specified) SC7180 (affected versions not specified) SC8180X (affected versions not specified) SDA660 (affected versions not specified) SDA845 (affected versions not specified) SDM630 (affected versions not specified) SDM636 (affected versions not specified) SDM660 (affected versions not specified) SDM670 (affected versions not specified) SDM710 (affected versions not specified) SDM845 (affected versions not specified) SDM850 (affected versions not specified) SDX55 (affected versions not specified) SM6150 (affected versions not specified) SM7150 (affected versions not specified) SM8150 (affected versions not specified) SXR1130 (affected versions not specified) SXR2130 (affected versions not specified)

Description: The issue is related to a possible integer overflow in the API due to a lack of check on large oid range count in the cert extension field. This affects various Snapdragon products, including Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wired Infrastructure and Networking, as well as specific chipsets.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2019-14056

Affected Products

Kamorta

Mdm9150

Mdm9205

Mdm9607

Mdm9650

Nicobar

Qcs404

Qcs405

Qcs605

Qcs610

Rennell

Sa6155P

Sc7180

Sc8180X

Sda660

Sda845

Sdm630

Sdm636

Sdm660

Sdm670

Sdm710

Sdm845

Sdm850

Sdx55

Sm6150

Sm7150

Sm8150

Sxr1130

Sxr2130

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wired Infrastructure/Networking

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-14056 · Security Note
• https://qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin · Vendor Advisory
• https://t.me/cibsecurity/14522 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/august-2020-bulletin · Note