Lucene search

QualcommCVE-2019-14105

HistoryApr 16, 2020 - 11:15 a.m.

CVE-2019-14105

2020-04-1611:15:14

CWE-787

qualcomm

web.nvd.nist.gov

cve-2019-14105

kernel

csl

uint16

uint32

memory overflow

snapdragon

industrial iot

mobile

sda845

sdm845

sm8150

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Kernel was reading the CSL defined reserved field as uint16 instead of uint32 which could lead to memory overflow in Snapdragon Industrial IOT, Snapdragon Mobile in SDA845, SDM845, SM8150

Affected configurations

Nvd

Node

qualcommsda845Match-

AND

qualcommsda845_firmwareMatch-

Node

qualcommsdm845Match-

AND

qualcommsdm845_firmwareMatch-

Node

qualcommsm8150Match-

AND

qualcommsm8150_firmwareMatch-

VendorProductVersionCPE
qualcommsda845-cpe:2.3:h:qualcomm:sda845:-:*:*:*:*:*:*:*
qualcommsda845_firmware-cpe:2.3:o:qualcomm:sda845_firmware:-:*:*:*:*:*:*:*
qualcommsdm845-cpe:2.3:h:qualcomm:sdm845:-:*:*:*:*:*:*:*
qualcommsdm845_firmware-cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
qualcommsm8150-cpe:2.3:h:qualcomm:sm8150:-:*:*:*:*:*:*:*
qualcommsm8150_firmware-cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qualcomm	sda845	-	cpe:2.3:h:qualcomm:sda845:-:::::::*
qualcomm	sda845_firmware	-	cpe:2.3:o:qualcomm:sda845_firmware:-:::::::*
qualcomm	sdm845	-	cpe:2.3:h:qualcomm:sdm845:-:::::::*
qualcomm	sdm845_firmware	-	cpe:2.3:o:qualcomm:sdm845_firmware:-:::::::*
qualcomm	sm8150	-	cpe:2.3:h:qualcomm:sm8150:-:::::::*
qualcomm	sm8150_firmware	-	cpe:2.3:o:qualcomm:sm8150_firmware:-:::::::*

CNA Affected

[
  {
    "product": "Snapdragon Industrial IOT, Snapdragon Mobile",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "SDA845, SDM845, SM8150"
      }
    ]
  }
]

References

www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2019-14105