PT-2020-9515 · Qualcomm · Qcm2150+72

Published 2020-06-22 · Updated 2020-06-25 · CVE-2019-14094

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto (affected versions not specified) Snapdragon Compute (affected versions not specified) Snapdragon Connectivity (affected versions not specified) Snapdragon Consumer Electronics Connectivity (affected versions not specified) Snapdragon Consumer IOT (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon IoT (affected versions not specified) Snapdragon Mobile (affected versions not specified) Snapdragon Voice & Music (affected versions not specified) Snapdragon Wearables (affected versions not specified) Snapdragon Wired Infrastructure and Networking (affected versions not specified) APQ8009 (affected versions not specified) APQ8053 (affected versions not specified) APQ8096AU (affected versions not specified) APQ8098 (affected versions not specified) IPQ6018 (affected versions not specified) IPQ8074 (affected versions not specified) Kamorta (affected versions not specified) MDM9150 (affected versions not specified) MDM9205 (affected versions not specified) MDM9206 (affected versions not specified) MDM9207C (affected versions not specified) MDM9607 (affected versions not specified) MDM9625 (affected versions not specified) MDM9635M (affected versions not specified) MDM9640 (affected versions not specified) MDM9645 (affected versions not specified) MDM9650 (affected versions not specified) MDM9655 (affected versions not specified) MSM8905 (affected versions not specified) MSM8909 (affected versions not specified) MSM8909W (affected versions not specified) MSM8917 (affected versions not specified) MSM8920 (affected versions not specified) MSM8937 (affected versions not specified) MSM8940 (affected versions not specified) MSM8953 (affected versions not specified) MSM8996 (affected versions not specified) MSM8996AU (affected versions not specified) MSM8998 (affected versions not specified) Nicobar (affected versions not specified) QCA8081 (affected versions not specified) QCM2150 (affected versions not specified) QCN7605 (affected versions not specified) QCS404 (affected versions not specified) QCS405 (affected versions not specified) QCS605 (affected versions not specified) QM215 (affected versions not specified) Rennell (affected versions not specified) SA415M (affected versions not specified) Saipan (affected versions not specified) SC7180 (affected versions not specified) SC8180X (affected versions not specified) SDA660 (affected versions not specified) SDA845 (affected versions not specified) SDM429 (affected versions not specified) SDM429W (affected versions not specified) SDM439 (affected versions not specified) SDM450 (affected versions not specified) SDM630 (affected versions not specified) SDM632 (affected versions not specified) SDM636 (affected versions not specified) SDM660 (affected versions not specified) SDM670 (affected versions not specified) SDM710 (affected versions not specified) SDM845 (affected versions not specified) SDM850 (affected versions not specified) SDX20 (affected versions not specified) SDX24 (affected versions not specified) SM6150 (affected versions not specified) SM7150 (affected versions not specified) SM8150 (affected versions not specified) SM8250 (affected versions not specified) SXR1130 (affected versions not specified) SXR2130 (affected versions not specified)

Description: The issue is related to an integer overflow in the diag command handler when a user inputs a large value for the number of tasks field in the request packet. This affects various Snapdragon products, including Auto, Compute, Connectivity, and others, across a range of specific models.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2019-14094

Affected Products

Apq8009

Apq8053

Apq8096Au

Apq8098

Ipq6018

Ipq8074

Kamorta

Mdm9150

Mdm9205

Mdm9206

Mdm9207C

Mdm9607

Mdm9625

Mdm9635M

Mdm9640

Mdm9645

Mdm9650

Mdm9655

Msm8905

Msm8909W

Msm8917

Msm8920

Msm8937

Msm8940

Msm8953

Msm8996

Msm8996Au

Msm8998

Nicobar

Qca8081

Qcm2150

Qcn7605

Qcs404

Qcs405

Qcs605

Qm215

Rennell

Sa415M

Sc7180

Sc8180X

Sda660

Sda845

Sdm429

Sdm439

Sdm450

Sdm630

Sdm632

Sdm636

Sdm660

Sdm670

Sdm710

Sdm845

Sdm850

Sdx20

Sdx24

Sm6150

Sm7150

Sm8150

Sm8250

Sxr1130

Sxr2130

Saipan

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Electronics Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

Snapdragon Wired Infrastructure/Networking

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-14094 · Security Note
• https://qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin · Vendor Advisory
• https://qualcomm.com/company/product-security/bulletins/june-2020-bulletin · Note
• https://t.me/cvenotify/4550 · Telegram Post
• https://t.me/cibsecurity/13035 · Telegram Post