High severity · published Nov 12, 2020
CVE-2020-11175
u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been deleted due to improper timer handling.' in Snapdragon Auto,…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been deleted due to improper timer handling.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009W, MSM8909W, QCS605, QM215, SA6155, SA6155P, SA8155, SA8155P, SDA640, SDA670, SDA855, SDM1000, SDM640, SDM670, SDM710, SDM845, SDX50M, SDX55, SDX55M, SM6125, SM6350, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SXR1120, SXR1130, SXR2130, SXR2130P
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8009w Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8909w Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qm215 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6155 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6155p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa8155 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa8155p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda640 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda670 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda855 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm1000 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11175
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11175
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
More from Apq8009w Firmware
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder
9.8
CVE-2022-40537
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response