High severity · published Jan 21, 2021
CVE-2020-11181
Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in Snapdragon Compute, Snapdragon…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Pm3003a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8009 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150b Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150c Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150l Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8250 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pmk8002 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pmr525 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pmx55 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qbt2000 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6390 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11181
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
More from Pm3003a Firmware
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2020-11182
Possible heap overflow while parsing NAL header due to lack of check of length of data received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
9.8
CVE-2020-11134
Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NAN management frame…