Lucene search

[email protected]CVE-2020-11209

HistoryNov 12, 2020 - 10:15 a.m.

CVE-2020-11209

2020-11-1210:15:13

CWE-863

[email protected]

web.nvd.nist.gov

cve-2020-11209

improper authorization

dsp process

unauthorized access

library version downgrade

sd820

sd821

sd855

sd675

sd660

sd429

sd439

qcs603

qcs605

sda855

sa6155p

sa6145p

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.7%

JSON

Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439

Affected configurations

NVD

Node

qualcommsd820_firmwareMatch-

AND

qualcommsd820Match-

Node

qualcommsd821_firmwareMatch-

AND

qualcommsd821Match-

Node

qualcommqcs603_firmwareMatch-

AND

qualcommqcs603Match-

Node

qualcommqcs605_firmwareMatch-

AND

qualcommqcs605Match-

Node

qualcommsda855_firmwareMatch-

AND

qualcommsda855Match-

Node

qualcommsa6155p_firmwareMatch-

AND

qualcommsa6155pMatch-

Node

qualcommsa6145p_firmwareMatch-

AND

qualcommsa6145pMatch-

Node

qualcommsa6155_firmwareMatch-

AND

qualcommsa6155Match-

Node

qualcommsa6155p_firmwareMatch-

AND

qualcommsa6155pMatch-

Node

qualcommsd855_firmwareMatch-

AND

qualcommsd855Match-

Node

qualcommsd_675_firmwareMatch-

AND

qualcommsd_675Match-

Node

qualcommsd660_firmwareMatch-

AND

qualcommsd660Match-

Node

qualcommsd429_firmwareMatch-

AND

qualcommsd429Match-

Node

qualcommsd439_firmwareMatch-

AND

qualcommsd439Match-

CPENameOperatorVersion
qualcomm:sd820_firmwarequalcomm sd820 firmwareeq-

CPE	Name	Operator	Version
qualcomm:sd820_firmware	qualcomm sd820 firmware	eq	-

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439"
      }
    ]
  }
]

References

blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

research.checkpoint.com/2021/pwn2own-qualcomm-dsp/

www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.7%

JSON

Related for CVE-2020-11209

cvelist1 prion1 nvd1 threatpost1