High severity · published Apr 16, 2020
CVE-2019-10574
Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
7.1
CVSS
1.6%
EPSS
No
On KEV
Description
Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8016, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCM2150, QCS605, QM215, Rennell, SC7180, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8009 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8016 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8017 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8076 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8096 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8096au Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8098 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9150 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9205 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9207c Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10574
Exploit
https://research.checkpoint.com/2019/the-road-to-qualcomm-trustzone-apps-fuzzing/
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
More from Apq8009 Firmware
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder
9.8
CVE-2022-40537
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response
