Qualcomm Snapdragon Auto up to SXR1130 ION System assertion

Summaryinfo

A vulnerability classified as critical was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice and Music. The impacted element is an unknown function of the component ION System. The manipulation results in assertion. This vulnerability is reported as CVE-2019-14049. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice and Music (Chip Software). Affected is an unknown function of the component ION System. The manipulation with an unknown input leads to a assertion vulnerability. CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MSM8953, QCN7605, QCS605, SC8180X, SDA845, SDM429, SDM439, SDM450, SDM632, SDX20, SDX24, SDX55, SM8150, SXR1130

The weakness was disclosed 02/07/2020 as confirmed security bulletin (Website). The advisory is shared for download at qualcomm.com. This vulnerability is traded as CVE-2019-14049 since 07/19/2019. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

The entries VDB-149764, VDB-149765, VDB-149768 and VDB-149769 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Music
• Snapdragon Auto
• Snapdragon Compute
• Snapdragon Consumer Electronics Connectivity
• Snapdragon Consumer IOT
• Snapdragon Industrial IOT
• Snapdragon Mobile
• Snapdragon Voice

Version

• APQ8017
• APQ8053
• APQ8096AU
• MDM9206
• MDM9207C
• MDM9607
• MDM9640
• MSM8953
• QCN7605
• QCS605
• SC8180X
• SDA845
• SDM429
• SDM439
• SDM450
• SDM632
• SDX20
• SDX24
• SDX55
• SM8150
• SXR1130

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion