CVE-2019-2276

25.07.2019, 17:15

Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received from user controlled space in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 49%

Vendor	Product	Version
qualcomm	mdm9607_firmware	-
qualcomm	msm8996au_firmware	-
qualcomm	qca6174a_firmware	-
qualcomm	qca6574au_firmware	-
qualcomm	qca9377_firmware	-
qualcomm	qca9379_firmware	-
qualcomm	qcs405_firmware	-
qualcomm	qcs605_firmware	-
qualcomm	sd_636_firmware	-
qualcomm	sd_665_firmware	-
qualcomm	sd_675_firmware	-
qualcomm	sd_712_firmware	-
qualcomm	sd_710_firmware	-
qualcomm	sd_670_firmware	-
qualcomm	sd_730_firmware	-
qualcomm	sd_820a_firmware	-
qualcomm	sd_845_firmware	-
qualcomm	sd_850_firmware	-
qualcomm	sd_855_firmware	-
qualcomm	sdm630_firmware	-
qualcomm	sdm660_firmware	-
qualcomm	sdx24_firmware	-

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin