Medium severity · published Mar 17, 2021
CVE-2020-11186
Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of input received in Snapdragon Auto, Snapdragon Compute,…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of input received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Csrb31024 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm3003a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7150a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7150l Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7250 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7250b Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8008 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8009 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150b Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150c Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm8150l Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11186
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
More from Csrb31024 Firmware
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
7.8
CVE-2023-33063
Use After Free in DSP Services
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2023-22388
Memory Corruption in Multi-mode Call Processor while processing bit mask API