PT-2021-9300 · Qualcomm+1 · Qualcomm Snapdragon+9

Published 2021-05-06 · Updated 2021-06-15 · CVE-2020-11292

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions (affected versions not specified) Qualcomm Snapdragon Compute versions (affected versions not specified) Qualcomm Snapdragon Connectivity versions (affected versions not specified) Qualcomm Snapdragon Consumer IOT versions (affected versions not specified) Qualcomm Snapdragon Industrial IOT versions (affected versions not specified) Qualcomm Snapdragon IoT versions (affected versions not specified) Qualcomm Snapdragon Mobile versions (affected versions not specified) Qualcomm Snapdragon Voice & Music versions (affected versions not specified) Qualcomm Snapdragon Wearables versions (affected versions not specified)

Description The issue is related to a possible buffer overflow in the voice service due to lack of input validation of parameters in the QMI Voice API. This could allow hackers to spy on Android devices by hiding malicious activity in modem chips. A vulnerability in the 5G modem data service could allow mobile hackers to remotely target Android users by injecting malicious code into a phone’s modem, gaining the ability to execute code, access mobile users’ call histories and text messages, and eavesdrop on phone calls. A malicious app can exploit the issue, which could affect up to 30 percent of Android phones.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-11292

Affected Products

Android

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

Qualcomm Snapdragon Wearables

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-11292 · Security Note
• https://qualcomm.com/company/product-security/bulletins/june-2021-bulletin · Vendor Advisory
• https://t.me/cvenotify/16328 · Telegram Post
• https://t.me/ckure/7855 · Telegram Post
• https://t.me/cybersecuritytechnologies/3302 · Telegram Post
• https://t.me/thehackernews/1196 · Telegram Post
• https://t.me/true_secator/1686 · Telegram Post