CVE-2019-10608 - Information disclosure issue occurs as there is no binding between the secure keypad session and the

CVE-2019-10608

Summary

Information disclosure issue occurs as there is no binding between the secure keypad session and the secure display session that allows user to take control of the REE to stop the secure keypad session and read the keypad input. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, MSM8905, MSM8909

References

https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin

Vulnerable Configurations

cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:msm8905_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:msm8905_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:msm8905:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:msm8905:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:msm8909_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:msm8909_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:msm8909:-:*:*:*:*:*:*:*
cpe:2.3:h:qualcomm:msm8909:-:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:N/A:N

refmap via4

confirm

https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin

Last major update

24-08-2020 - 17:37

Published

16-04-2020 - 11:15

Last modified

24-08-2020 - 17:37