CVE-2020-11202

Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCM6125, QCS410, QCS603, QCS605, QCS610, QCS6125, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDA640, SDA670, SDA845, SDM640, SDM670, SDM710, SDM830, SDM845, SDX50M, SDX55, SDX55M, SM6125, SM6150, SM6150P, SM6250, SM6250P, SM7125, SM7150, SM7150P, SM8150, SM8150P

Affected

Qualcomm, Inc. · Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.54% chance of exploitation in the next 30 days, 75th percentile

Published

2020-11-12

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/

Security advisories

• https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
• https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril
• https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp

References

• CVE Record
• NVD entry