Critical severity · published Jan 21, 2021
CVE-2020-11137
Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bounds resulting in possible device instability in Snapdragon…
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bounds resulting in possible device instability in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apq8009 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8009w · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8017 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8030 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8037 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8052 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8053 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8056 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8062 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8064 · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8064au · Qualcomm
All versions, or not specified · source: NVD
AP
Apq8076 · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11137
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
More from Apq8009
9.8
CVE-2020-11283
A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
9.8
CVE-2020-3691
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
9.8
CVE-2020-3686
Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array without checking the length of array in Snapdragon Auto,…
9.8
CVE-2020-11216
Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
9.8
CVE-2020-11213
Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, Snapdragon Compute, Snapdragon…