CVE-2019-10616

05.03.2020, 09:15

Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8016, MDM9150, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8998, SA6155P, SDX24

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
qualcomm	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 11%

Vendor	Product	Version
qualcomm	apq8009_firmware	-
qualcomm	apq8016_firmware	-
qualcomm	mdm9150_firmware	-
qualcomm	mdm9607_firmware	-
qualcomm	mdm9650_firmware	-
qualcomm	msm8905_firmware	-
qualcomm	msm8909_firmware	-
qualcomm	msm8909w_firmware	-
qualcomm	msm8998_firmware	-
qualcomm	sa6155p_firmware	-
qualcomm	sdx24_firmware	-
qualcomm	mdm9206_firmware	-

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin