Qualcomm Snapdragon Auto up to SXR1130 Data Structure buffer overflow

Summaryinfo

A vulnerability was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice , Music and Snapdragon Wearables. It has been rated as critical. Impacted is an unknown function of the component Data Structure Handler. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2019-10496. The attack is restricted to local execution. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice , Music and Snapdragon Wearables (Chip Software). Affected by this vulnerability is an unknown function of the component Data Structure Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130

The weakness was disclosed 11/06/2019 (Website). The advisory is shared at source.android.com. This vulnerability is known as CVE-2019-10496 since 03/29/2019. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Applying a patch is able to eliminate this problem.

The entries VDB-145114, VDB-145115, VDB-145116 and VDB-145118 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Music
• Snapdragon Auto
• Snapdragon Compute
• Snapdragon Connectivity
• Snapdragon Consumer IOT
• Snapdragon Industrial IOT
• Snapdragon Mobile
• Snapdragon Voice
• Snapdragon Wearables

Version

• MSM8909W
• MSM8996AU
• QCS605
• SD 8CX
• SD 427
• SD 429
• SD 430
• SD 435
• SD 439
• SD 450
• SD 625
• SD 632
• SD 636
• SD 665
• SD 670
• SD 675
• SD 710
• SD 712
• SD 730
• SD 820
• SD 820A
• SD 835
• SD 845
• SD 850
• SD 855
• SDA660
• SDM439
• SDM630
• SDM660
• Snapdragon_High_Med_2016
• SXR1130

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion