Qualcomm Snapdragon Auto up to SXR2130 Radio Request array index

Summaryinfo

A vulnerability categorized as critical has been discovered in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice and Music. The affected element is an unknown function of the component Radio Handler. Such manipulation as part of Request leads to array index. This vulnerability is documented as CVE-2019-14131. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice and Music (Chip Software) and classified as critical. Affected by this issue is an unknown functionality of the component Radio Handler. The manipulation as part of a Request leads to a array index vulnerability. Using CWE to declare the problem leads to CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Out of bound write can occur in radio measurement request if STA receives multiple invalid rrm measurement request from AP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, MSM8998, Nicobar, QCA6574AU, QCS605, Rennell, SA6155P, Saipan, SC8180X, SDM660, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130

The weakness was released 04/16/2020 as confirmed security bulletin (Website). The advisory is shared for download at qualcomm.com. This vulnerability is handled as CVE-2019-14131 since 07/19/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-153855, VDB-153856, VDB-153857 and VDB-153858. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Music
• Snapdragon Auto
• Snapdragon Compute
• Snapdragon Consumer IOT
• Snapdragon Industrial IOT
• Snapdragon Mobile
• Snapdragon Voice

Version

• APQ8053
• APQ8096AU
• MSM8998
• Nicobar
• QCA6574AU
• QCS605
• Rennell
• SA6155P
• Saipan
• SC8180X
• SDM660
• SDM710
• SDM845
• SDX20
• SDX24
• SDX55
• SM6150
• SM7150
• SM8150
• SM8250
• SXR2130

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion