PT-2021-9290 · Qualcomm · Snapdragon Connectivity+7

Published 2021-02-22 · Updated 2021-07-21 · CVE-2020-11282

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Snapdragon Auto (affected versions not specified) Snapdragon Compute (affected versions not specified) Snapdragon Connectivity (affected versions not specified) Snapdragon Consumer IOT (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon Mobile (affected versions not specified) Snapdragon Voice & Music (affected versions not specified) Snapdragon Wearables (affected versions not specified)

Description The issue is related to improper access control when using mmap with the kgsl driver and a special offset value. This can allow mapping the memstore of the GPU to user space. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. Technical details include the use of mmap with the kgsl driver and a special offset value to map the memstore of the GPU to user space.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-11282

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

References · 4

• https://qualcomm.com/company/product-security/bulletins/february-2021-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11282 · Security Note
• https://t.me/cibsecurity/23900 · Telegram Post
• https://t.me/cvenotify/10576 · Telegram Post