High severity · published Apr 7, 2021
CVE-2020-11237
Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon Compute, Snapdragon…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Csrb31024 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm3003a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm456 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm6150 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm6150a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm6150l Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm6250 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm6350 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7150a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7150l Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7250 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm7250b Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11237
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
More from Csrb31024 Firmware
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
7.8
CVE-2023-33063
Use After Free in DSP Services
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2023-22388
Memory Corruption in Multi-mode Call Processor while processing bit mask API