Lucene search

[email protected]CVE-2019-14130

HistoryJul 30, 2020 - 12:15 p.m.

CVE-2019-14130

2020-07-3012:15:11

CWE-119

CWE-787

[email protected]

web.nvd.nist.gov

cve

memory corruption

trusted application

buffer size mismatch

snapdragon auto

snapdragon compute

snapdragon mobile

snapdragon wired infrastructure

kamorta

qcs404

rennell

sc7180

sdx55

sm6150

sm7150

sm8250

sxr2130

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130

Affected configurations

NVD

Node

qualcommkamortaMatch-

AND

qualcommkamorta_firmwareMatch-

Node

qualcommqcs404Match-

AND

qualcommqcs404_firmwareMatch-

Node

qualcommrennellMatch-

AND

qualcommrennell_firmwareMatch-

Node

qualcommsc7180Match-

AND

qualcommsc7180_firmwareMatch-

Node

qualcommsdx55Match-

AND

qualcommsdx55_firmwareMatch-

Node

qualcommsm6150Match-

AND

qualcommsm6150_firmwareMatch-

Node

qualcommsm7150Match-

AND

qualcommsm7150_firmwareMatch-

Node

qualcommsm8250Match-

AND

qualcommsm8250_firmwareMatch-

Node

qualcommsxr2130_firmwareMatch-

AND

qualcommsxr2130Match-

CPENameOperatorVersion
qualcomm:kamorta_firmwarequalcomm kamorta firmwareeq-

CPE	Name	Operator	Version
qualcomm:kamorta_firmware	qualcomm kamorta firmware	eq	-

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130"
      }
    ]
  }
]

References

www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin

www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for CVE-2019-14130

nvd1 cvelist1 prion1