cnvd - cnvd-2020-03573

cnvd-2020-03573

Vulnerability from cnvd

Title: 多款Qualcomm产品资源管理错误漏洞（CNVD-2020-03573）

Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的一款中央处理器（CPU）产品。

多款Qualcomm产品中的WLAN Host存在资源管理错误漏洞。目前没有详细漏洞细节提供。

Severity: 高

Patch Name: 多款Qualcomm产品资源管理错误漏洞（CNVD-2020-03573）的补丁

Patch Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的一款中央处理器（CPU）产品。

多款Qualcomm产品中的WLAN Host存在资源管理错误漏洞。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin

Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-10536

Impacted products

Name
['Qualcomm MDM 9607', 'Qualcomm MDM 9650', 'Qualcomm MSM 8996AU', 'Qualcomm QCS 605', 'Qualcomm SDA 660', 'Qualcomm SDM 630', 'Qualcomm SDM 660', 'Qualcomm SDX 24', 'Qualcomm QCS 405', 'Qualcomm SDX 20', 'Qualcomm MDM 9206', 'Qualcomm QCA 6574AU', 'Qualcomm IPQ 4019', 'Qualcomm IPQ 8064', 'Qualcomm IPQ 8074', 'Qualcomm MDM 9640', 'Qualcomm QCA 6174A', 'Qualcomm QCA 9377', 'Qualcomm QCA 9379', 'Qualcomm SXR 1130', 'Qualcomm QCA 8081', 'Qualcomm MSM 8998', 'Qualcomm Nicobar', 'Qualcomm SDA 845', 'Qualcomm SDM 636', 'Qualcomm SDM 670', 'Qualcomm SDM 710', 'Qualcomm SDM 845', 'Qualcomm SM 6150', 'Qualcomm SM 7150', 'Qualcomm SM 8150', 'Qualcomm SM 8250', 'Qualcomm SXR 2130', 'Qualcomm APQ 8017', 'Qualcomm APQ 8053', 'Qualcomm APQ 8009', 'Qualcomm APQ 8096AU', 'Qualcomm APQ 8098', 'Qualcomm MSM 8917', 'Qualcomm MSM 8920', 'Qualcomm MSM 8937', 'Qualcomm MSM 8940', 'Qualcomm MSM 8953', 'Qualcomm SDM 450', 'Qualcomm SDX 55', 'Qualcomm MDM 9207C', 'Qualcomm QCN 7605']

Name

['Qualcomm MDM 9607', 'Qualcomm MDM 9650', 'Qualcomm MSM 8996AU', 'Qualcomm QCS 605', 'Qualcomm SDA 660', 'Qualcomm SDM 630', 'Qualcomm SDM 660', 'Qualcomm SDX 24', 'Qualcomm QCS 405', 'Qualcomm SDX 20', 'Qualcomm MDM 9206', 'Qualcomm QCA 6574AU', 'Qualcomm IPQ 4019', 'Qualcomm IPQ 8064', 'Qualcomm IPQ 8074', 'Qualcomm MDM 9640', 'Qualcomm QCA 6174A', 'Qualcomm QCA 9377', 'Qualcomm QCA 9379', 'Qualcomm SXR 1130', 'Qualcomm QCA 8081', 'Qualcomm MSM 8998', 'Qualcomm Nicobar', 'Qualcomm SDA 845', 'Qualcomm SDM 636', 'Qualcomm SDM 670', 'Qualcomm SDM 710', 'Qualcomm SDM 845', 'Qualcomm SM 6150', 'Qualcomm SM 7150', 'Qualcomm SM 8150', 'Qualcomm SM 8250', 'Qualcomm SXR 2130', 'Qualcomm APQ 8017', 'Qualcomm APQ 8053', 'Qualcomm APQ 8009', 'Qualcomm APQ 8096AU', 'Qualcomm APQ 8098', 'Qualcomm MSM 8917', 'Qualcomm MSM 8920', 'Qualcomm MSM 8937', 'Qualcomm MSM 8940', 'Qualcomm MSM 8953', 'Qualcomm SDM 450', 'Qualcomm SDX 55', 'Qualcomm MDM 9207C', 'Qualcomm QCN 7605']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-10536",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-10536"
    }
  },
  "description": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002\n\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684WLAN Host\u5b58\u5728\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-03573",
  "openTime": "2020-02-04",
  "patchDescription": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684WLAN Host\u5b58\u5728\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-03573\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Qualcomm MDM 9607",
      "Qualcomm MDM 9650",
      "Qualcomm MSM 8996AU",
      "Qualcomm QCS 605",
      "Qualcomm SDA 660",
      "Qualcomm SDM 630",
      "Qualcomm SDM 660",
      "Qualcomm SDX 24",
      "Qualcomm QCS 405",
      "Qualcomm SDX 20",
      "Qualcomm MDM 9206",
      "Qualcomm QCA 6574AU",
      "Qualcomm IPQ 4019",
      "Qualcomm IPQ 8064",
      "Qualcomm IPQ 8074",
      "Qualcomm MDM 9640",
      "Qualcomm QCA 6174A",
      "Qualcomm QCA 9377",
      "Qualcomm QCA 9379",
      "Qualcomm SXR 1130",
      "Qualcomm QCA 8081",
      "Qualcomm MSM 8998",
      "Qualcomm Nicobar",
      "Qualcomm SDA 845",
      "Qualcomm SDM 636",
      "Qualcomm SDM 670",
      "Qualcomm SDM 710",
      "Qualcomm SDM 845",
      "Qualcomm SM 6150",
      "Qualcomm SM 7150",
      "Qualcomm SM 8150",
      "Qualcomm SM 8250",
      "Qualcomm SXR 2130",
      "Qualcomm APQ 8017",
      "Qualcomm APQ 8053",
      "Qualcomm APQ 8009",
      "Qualcomm APQ 8096AU",
      "Qualcomm APQ 8098",
      "Qualcomm MSM 8917",
      "Qualcomm MSM 8920",
      "Qualcomm MSM 8937",
      "Qualcomm MSM 8940",
      "Qualcomm MSM 8953",
      "Qualcomm SDM 450",
      "Qualcomm SDX 55",
      "Qualcomm MDM 9207C",
      "Qualcomm QCN 7605"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-10536",
  "serverity": "\u9ad8",
  "submitTime": "2019-12-25",
  "title": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-03573\uff09"
}

CVE-2019-10536 (GCVE-0-2019-10536)

Vulnerability from cvelistv5

Published

2019-12-18 05:25

Modified

2024-08-04 22:24

Severity ?

CWE

Double Free Issue in WLAN Host

Summary

Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

References

▼	URL	Tags
	https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking	Version: APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:24:18.727Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Double Free Issue in WLAN Host",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-18T05:25:44",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@qualcomm.com",
          "ID": "CVE-2019-10536",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Qualcomm, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Double Free Issue in WLAN Host"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin",
              "refsource": "CONFIRM",
              "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2019-10536",
    "datePublished": "2019-12-18T05:25:44",
    "dateReserved": "2019-03-29T00:00:00",
    "dateUpdated": "2024-08-04T22:24:18.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted