Medium severity · published Jan 21, 2021
CVE-2020-11151
Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Compute, Snapdragon…
6.4
CVSS
0.1%
EPSS
No
On KEV
Description
Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Pm3003a · Qualcomm
All versions, or not specified · source: NVD
PM
Pm6125 · Qualcomm
All versions, or not specified · source: NVD
PM
Pm6150 · Qualcomm
All versions, or not specified · source: NVD
PM
Pm6150a · Qualcomm
All versions, or not specified · source: NVD
PM
Pm6150l · Qualcomm
All versions, or not specified · source: NVD
PM
Pm6350 · Qualcomm
All versions, or not specified · source: NVD
PM
Pm640a · Qualcomm
All versions, or not specified · source: NVD
PM
Pm640l · Qualcomm
All versions, or not specified · source: NVD
PM
Pm640p · Qualcomm
All versions, or not specified · source: NVD
PM
Pm7150a · Qualcomm
All versions, or not specified · source: NVD
PM
Pm7150l · Qualcomm
All versions, or not specified · source: NVD
PM
Pm7250 · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11151
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11151
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
Patch
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
More from Pm3003a
9.8
CVE-2020-11283
A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
9.8
CVE-2020-11225
Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
9.8
CVE-2020-11216
Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
9.8
CVE-2020-11197
Possible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip with invalid data in Snapdragon Auto,…
9.8
CVE-2020-11167
Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto, Snapdragon Compute, Snapdragon…