Lucene search

K
cvelistQualcommCVELIST:CVE-2024-21460
HistoryJul 01, 2024 - 2:17 p.m.

CVE-2024-21460 Use of Insufficiently Random Values in Core

2024-07-0114:17:07
CWE-330
qualcomm
www.cve.org
7
cve-2024-21460
insufficiently random values
core
aslr
information disclosure
imem
secure ddr
virtual address space

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0

Percentile

9.2%

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Snapdragon Compute",
      "Snapdragon Consumer IOT",
      "Snapdragon Industrial IOT",
      "Snapdragon Mobile"
    ],
    "product": "Snapdragon",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "FastConnect 6900"
      },
      {
        "status": "affected",
        "version": "FastConnect 7800"
      },
      {
        "status": "affected",
        "version": "QCM8550"
      },
      {
        "status": "affected",
        "version": "QCS8550"
      },
      {
        "status": "affected",
        "version": "SG8275P"
      },
      {
        "status": "affected",
        "version": "SM8550P"
      },
      {
        "status": "affected",
        "version": "Snapdragon 8 Gen 2 Mobile Platform"
      },
      {
        "status": "affected",
        "version": "Snapdragon 8+ Gen 2 Mobile Platform"
      },
      {
        "status": "affected",
        "version": "WCD9380"
      },
      {
        "status": "affected",
        "version": "WCD9385"
      },
      {
        "status": "affected",
        "version": "WCD9390"
      },
      {
        "status": "affected",
        "version": "WCD9395"
      },
      {
        "status": "affected",
        "version": "WSA8840"
      },
      {
        "status": "affected",
        "version": "WSA8845"
      },
      {
        "status": "affected",
        "version": "WSA8845H"
      }
    ]
  }
]

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0

Percentile

9.2%

Related for CVELIST:CVE-2024-21460