Critical severity · published Nov 2, 2020
CVE-2020-3654
u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6390, QCA6574AU, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Agatti Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8096au Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8098 Firmware · Qualcomm
All versions, or not specified · source: NVD
BF
Bitra Firmware · Qualcomm
All versions, or not specified · source: NVD
KF
Kamorta Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8905 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8909w Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8917 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8940 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8953 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3654
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin
More from Agatti Firmware
9.8
CVE-2020-3692
u'Possible buffer overflow while updating output buffer for IMEI and Gateway Address due to lack of check of input validation for parameters received from server' in Snapdragon…
9.8
CVE-2020-3673
u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto,…
9.1
CVE-2020-3670
u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element(IEI) NAS message container' in Snapdragon Auto,…
7.8
CVE-2020-3690
u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
7.8
CVE-2020-3684
u'QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them without validation' in Snapdragon Auto,…