High severity · published Jan 21, 2021
CVE-2020-11214
Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it as more number of immutable schedules in Snapdragon Auto,…
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it as more number of immutable schedules in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AQ
Aqt1000 · Qualcomm
All versions, or not specified · source: NVD
AR
Ar8031 · Qualcomm
All versions, or not specified · source: NVD
AR
Ar8035 · Qualcomm
All versions, or not specified · source: NVD
CS
Csr8811 · Qualcomm
All versions, or not specified · source: NVD
CS
Csra6620 · Qualcomm
All versions, or not specified · source: NVD
CS
Csra6640 · Qualcomm
All versions, or not specified · source: NVD
CS
Csrb31024 · Qualcomm
All versions, or not specified · source: NVD
IP
Ipq5010 · Qualcomm
All versions, or not specified · source: NVD
IP
Ipq5018 · Qualcomm
All versions, or not specified · source: NVD
IP
Ipq6000 · Qualcomm
All versions, or not specified · source: NVD
IP
Ipq6005 · Qualcomm
All versions, or not specified · source: NVD
IP
Ipq6010 · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11214
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
More from Aqt1000
9.8
CVE-2020-11283
A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
9.8
CVE-2020-3691
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
9.8
CVE-2020-3686
Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array without checking the length of array in Snapdragon Auto,…
9.8
CVE-2020-11225
Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
9.8
CVE-2020-11216
Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…