CVE-2019-10504

06.11.2019, 17:15

Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
qualcomm	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 48%

Vendor	Product	Version
qualcomm	mdm9206_firmware	-
qualcomm	mdm9607_firmware	-
qualcomm	msm8909w_firmware	-
qualcomm	qualcomm_215_firmware	-
qualcomm	sd_210_firmware	-
qualcomm	sd_212_firmware	-
qualcomm	sd_205_firmware	-
qualcomm	sd_425_firmware	-
qualcomm	sd_427_firmware	-
qualcomm	sd_430_firmware	-
qualcomm	sd_435_firmware	-
qualcomm	sd_439_firmware	-
qualcomm	sd_429_firmware	-
qualcomm	sd_450_firmware	-
qualcomm	sd_625_firmware	-
qualcomm	sd_632_firmware	-
qualcomm	sd_636_firmware	-
qualcomm	sd_650_firmware	-
qualcomm	sd_652_firmware	-
qualcomm	sd_665_firmware	-
qualcomm	sd_845_firmware	-
qualcomm	sd_850_firmware	-
qualcomm	sda660_firmware	-
qualcomm	sdm439_firmware	-
qualcomm	sdm630_firmware	-
qualcomm	sdm660_firmware	-
qualcomm	snapdragon_high_med_2016_firmware	-

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

https://source.android.com/security/bulletin/