PT-2020-9491 · Qualcomm · Snapdragon Connectivity+9

Published 2020-06-02 · Updated 2021-07-21 · CVE-2019-14067

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions APQ8009 through SXR2130

Description: Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. This issue affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, and Snapdragon Wired Infrastructure and Networking.

Recommendations: For Qualcomm Snapdragon versions APQ8009 through SXR2130, consider using time-constant functions to compare sensitive data as a mitigation measure. As a temporary workaround, consider disabling the use of memcmp function for sensitive data comparisons until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2019-14067

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

Snapdragon Wired Infrastructure/Networking

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-14067 · Security Note
• https://qualcomm.com/company/product-security/bulletins/may-2020-bulletin · Vendor Advisory
• https://t.me/cvenotify/4111 · Telegram Post