Medium severity · published Apr 16, 2020
CVE-2019-14075
Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9607, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCS605, Rennell, Saipan, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8917 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8920 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8937 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8940 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8953 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8998 Firmware · Qualcomm
All versions, or not specified · source: NVD
NF
Nicobar Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
RF
Rennell Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Saipan Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm450 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14075
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14075
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
More from Mdm9607 Firmware
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder
9.8
CVE-2022-40537
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response
9.8
CVE-2022-40515
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms