PT-2020-9511 · Qualcomm · Qcs610+21

Published 2020-09-08 · Updated 2020-09-11 · CVE-2019-14089

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto versions prior to the fixed version Snapdragon Compute versions prior to the fixed version Snapdragon Consumer IOT versions prior to the fixed version Snapdragon Industrial IOT versions prior to the fixed version Snapdragon Mobile versions prior to the fixed version Snapdragon Voice & Music versions prior to the fixed version Snapdragon Wired Infrastructure and Networking versions prior to the fixed version Kamorta versions prior to the fixed version Nicobar versions prior to the fixed version QCS404 versions prior to the fixed version QCS610 versions prior to the fixed version Rennell versions prior to the fixed version SA515M versions prior to the fixed version SA6155P versions prior to the fixed version SC7180 versions prior to the fixed version SC8180X versions prior to the fixed version SDX55 versions prior to the fixed version SM6150 versions prior to the fixed version SM7150 versions prior to the fixed version SM8150 versions prior to the fixed version SM8250 versions prior to the fixed version SXR2130 versions prior to the fixed version

Description: The issue is related to the Keymaster attestation key and device IDs provisioning process, which is incorrectly allowed to be re-provisioned after a user data erase or a factory reset. This process is supposed to be a one-time process.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2019-14089

Affected Products

Kamorta

Nicobar

Qcs404

Qcs610

Rennell

Sa515M

Sa6155P

Sc7180

Sc8180X

Sdx55

Sm6150

Sm7150

Sm8150

Sm8250

Sxr2130

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wired Infrastructure/Networking

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-14089 · Security Note
• https://qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin · Vendor Advisory
• https://t.me/cibsecurity/14519 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/august-2020-bulletin · Note