Qualcomm Snapdragon Auto up to SXR2130 Session Object memory corruption

Summaryinfo

A vulnerability, which was classified as critical, was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking up to SXR2130. This affects an unknown part of the component Session Handler. Such manipulation as part of Object leads to memory corruption. This vulnerability is listed as CVE-2019-14025. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking up to SXR2130 (Chip Software). Affected by this issue is some unknown functionality of the component Session Handler. The manipulation as part of a Object leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

u'When a new session is created, Object is returned that contains TZ addresses and it get passed to HLOS as an handle to refer to a particular session and can cause TZ to jump to a invalid address' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, QCS610, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130

The weakness was presented 09/08/2020 as confirmed security bulletin (Website). The advisory is available at qualcomm.com. This vulnerability is handled as CVE-2019-14025 since 07/19/2019. Local access is required to approach this attack. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

See VDB-160766, VDB-160767, VDB-160768 and VDB-160769 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Networking
• Snapdragon Auto
• Snapdragon Compute
• Snapdragon Consumer IOT
• Snapdragon Industrial IOT
• Snapdragon Mobile
• Snapdragon Wired Infrastructure

Version

• Kamorta
• QCS404
• QCS610
• Rennell
• SC7180
• SDX55
• SM6150
• SM7150
• SM8250
• SXR2130

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion