High severity · published Apr 16, 2020
CVE-2019-10624
While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdragon Auto,…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, MSM8996AU, QCA6574AU, QCN7605, Rennell, SC8180X, SDM710, SDX55, SM7150, SM8150, SM8250, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8096au Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcn7605 Firmware · Qualcomm
All versions, or not specified · source: NVD
RF
Rennell Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sc8180x Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm710 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdx55 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm7150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8250 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sxr2130 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10624
Patch
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
More from Apq8096au Firmware
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder
9.8
CVE-2022-40537
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response