High severity · published Sep 8, 2020
CVE-2020-3629
u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for the DSP attributes' in Snapdragon Auto,…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for the DSP attributes' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, Kamorta, Rennell, SC7180, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Bitra Firmware · Qualcomm
All versions, or not specified · source: NVD
KF
Kamorta Firmware · Qualcomm
All versions, or not specified · source: NVD
RF
Rennell Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sc7180 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm845 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm6150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm7150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8250 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sxr2130 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3629
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3629
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin
More from Bitra Firmware
9.8
CVE-2020-3703
u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link…
9.8
CVE-2020-3673
u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto,…
9.8
CVE-2020-3654
u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2020-11116
u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapdragon Auto, Snapdragon Compute, Snapdragon…
7.8
CVE-2020-3694
u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom' in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile,…