Lucene search

QualcommCVE-2020-3625

HistoryJun 02, 2020 - 3:15 p.m.

CVE-2020-3625

2020-06-0215:15:13

CWE-120

qualcomm

web.nvd.nist.gov

cve-2020-3625

dsp capabilities

stack out of bounds

snapdragon auto

snapdragon consumer iot

snapdragon mobile

sm8250

sxr2130

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in SM8250, SXR2130

Affected configurations

Nvd

Node

qualcommsm8250_firmwareMatch-

AND

qualcommsm8250Match-

Node

qualcommsxr2130_firmwareMatch-

AND

qualcommsxr2130Match-

VendorProductVersionCPE
qualcommsm8250_firmware-cpe:2.3:o:qualcomm:sm8250_firmware:-:*:*:*:*:*:*:*
qualcommsm8250-cpe:2.3:h:qualcomm:sm8250:-:*:*:*:*:*:*:*
qualcommsxr2130_firmware-cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*
qualcommsxr2130-cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qualcomm	sm8250_firmware	-	cpe:2.3:o:qualcomm:sm8250_firmware:-:::::::*
qualcomm	sm8250	-	cpe:2.3:h:qualcomm:sm8250:-:::::::*
qualcomm	sxr2130_firmware	-	cpe:2.3:o:qualcomm:sxr2130_firmware:-:::::::*
qualcomm	sxr2130	-	cpe:2.3:h:qualcomm:sxr2130:-:::::::*

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "SM8250, SXR2130"
      }
    ]
  }
]

References

www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2020-3625