Qualcomm Snapdragon Auto up to SXR1130 Audio array index

Summaryinfo

A vulnerability marked as critical has been reported in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice , Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking. This impacts an unknown function of the component Audio. The manipulation leads to array index. This vulnerability is documented as CVE-2019-10512. The attack needs to be performed locally. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice , Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (Chip Software) and classified as critical. This issue affects an unknown code of the component Audio. The manipulation with an unknown input leads to a array index vulnerability. Using CWE to declare the problem leads to CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SXR1130

The weakness was released 11/06/2019 (Website). The advisory is shared at source.android.com. The identification of this vulnerability is CVE-2019-10512 since 03/29/2019. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Applying a patch is able to eliminate this problem.

Entries connected to this vulnerability are available at VDB-145114, VDB-145115, VDB-145116 and VDB-145117. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Music
• Networking
• Snapdragon Auto
• Snapdragon Compute
• Snapdragon Consumer IOT
• Snapdragon Industrial IOT
• Snapdragon IoT
• Snapdragon Mobile
• Snapdragon Voice
• Snapdragon Wearables
• Snapdragon Wired Infrastructure

Version

• 16
• MDM9206
• MDM9607
• MDM9640
• MDM9650
• MSM8909W
• MSM8996AU
• QCS405
• QCS605
• SD 415
• SD 450
• SD 615
• SD 625
• SD 632
• SD 636
• SD 665
• SD 670
• SD 675
• SD 710
• SD 712
• SD 730
• SD 820
• SD 820A
• SD 835
• SD 845
• SD 850
• SD 855
• SDA660
• SDM439
• SDM630
• SDM660
• SDX20
• SDX24
• SXR1130

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion