Qualcomm Snapdragon Auto up to Snapdragon_High_Med_2016 Kernel out-of-bounds

Summaryinfo

A vulnerability marked as problematic has been reported in Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice , Music, Snapdragon Wired Infrastructure and Networking. Affected is an unknown function of the component Kernel. This manipulation causes out-of-bounds. This vulnerability is handled as CVE-2019-2318. It is possible to launch the attack on the local host. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice , Music, Snapdragon Wired Infrastructure and Networking (Chip Software) and classified as problematic. Affected by this vulnerability is an unknown code of the component Kernel. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8017, APQ8053, APQ8096, APQ8096AU, IPQ8074, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, QCA8081, QM215, SDM429, SDM439, SDM450, SDM632, Snapdragon_High_Med_2016

The weakness was released 11/21/2019 as confirmed security bulletin (Website). The advisory is shared at qualcomm.com. This vulnerability is known as CVE-2019-2318 since 12/10/2018. The exploitation appears to be easy. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-143508, VDB-146051, VDB-146046 and VDB-146047. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Music
• Networking
• Snapdragon Auto
• Snapdragon Connectivity
• Snapdragon Consumer IOT
• Snapdragon Industrial IOT
• Snapdragon Mobile
• Snapdragon Voice
• Snapdragon Wired Infrastructure

Version

• APQ8017
• APQ8053
• APQ8096
• APQ8096AU
• IPQ8074
• MSM8917
• MSM8920
• MSM8937
• MSM8940
• MSM8953
• MSM8996
• MSM8996AU
• QCA8081
• QM215
• SDM429
• SDM439
• SDM450
• SDM632
• Snapdragon_High_Med_2016

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion