High severity · published May 24, 2019
CVE-2019-2248
Buffer overflow can occur if invalid header tries to overwrite the existing buffer which fix size allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Buffer overflow can occur if invalid header tries to overwrite the existing buffer which fix size allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 820, SD 820A, SD 845 / SD 850, SDM439, SDM660, SDX20
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2F
215 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9150 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9650 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8909w Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qm215 Firmware · Qualcomm
All versions, or not specified · source: NVD
S2
SD 205 Firmware · Qualcomm
All versions, or not specified · source: NVD
S2
SD 210 Firmware · Qualcomm
All versions, or not specified · source: NVD
S2
SD 212 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 415 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2248
Patch
https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
More from 215 Firmware
9.8
CVE-2023-21631
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network
7.8
CVE-2024-33042
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
7.8
CVE-2023-28575
The cam_get_device_priv function does not check the type of handle being returned (device/session/link)
7.5
CVE-2023-33020
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE
7.5
CVE-2023-33019
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE