Qualcomm Snapdragon Auto up to SXR2130 buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Mobile, Snapdragon Voice , Music, Snapdragon Wired Infrastructure and Networking. Affected is an unknown function. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2019-14111. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Mobile, Snapdragon Voice , Music, Snapdragon Wired Infrastructure and Networking (Chip Software). It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Possible buffer overflow while handling NAN reception of NMF in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, Nicobar, QCA6390, QCA8081, QCN7605, QCS404, QCS405, Rennell, SC7180, SC8180X, SM6150, SM7150, SM8150, SXR2130

The weakness was shared 04/16/2020 as confirmed security bulletin (Website). The advisory is shared at qualcomm.com. This vulnerability is known as CVE-2019-14111 since 07/19/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

The entries VDB-153855, VDB-153856, VDB-153857 and VDB-153858 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Music
• Networking
• Snapdragon Auto
• Snapdragon Compute
• Snapdragon Connectivity
• Snapdragon Consumer Electronics Connectivity
• Snapdragon Mobile
• Snapdragon Voice
• Snapdragon Wired Infrastructure

Version

• IPQ6018
• IPQ8074
• Nicobar
• QCA6390
• QCA8081
• QCN7605
• QCS404
• QCS405
• Rennell
• SC7180
• SC8180X
• SM6150
• SM7150
• SM8150
• SXR2130

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion