cnvd - cnvd-2020-16064

cnvd-2020-16064

Vulnerability from cnvd

Title: 多款Qualcomm产品缓冲区溢出漏洞（CNVD-2020-16064）

Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。MDM9607是一款中央处理器（CPU）产品。SDX24是一款调制解调器。

多款Qualcomm产品中的WLAN存在安全漏洞。攻击者可利用该漏洞造成缓冲区溢出。

Severity: 中

Patch Name: 多款Qualcomm产品缓冲区溢出漏洞（CNVD-2020-16064）的补丁

Patch Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。MDM9607是一款中央处理器（CPU）产品。SDX24是一款调制解调器。

多款Qualcomm产品中的WLAN存在安全漏洞。攻击者可利用该漏洞造成缓冲区溢出。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin

Reference: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin

Impacted products

Name
['Qualcomm MDM 9607', 'Qualcomm MDM 9650', 'Qualcomm MSM 8996AU', 'Qualcomm QCS 605', 'Qualcomm SDA 660', 'Qualcomm SDM 660', 'Qualcomm SDX 24', 'Qualcomm QCS 405', 'Qualcomm SDX 20', 'Qualcomm MDM 9206', 'Qualcomm QCA 6574AU', 'Qualcomm IPQ 4019', 'Qualcomm IPQ 8064', 'Qualcomm IPQ 8074', 'Qualcomm MDM 9640', 'Qualcomm QCA 6174A', 'Qualcomm QCA 9377', 'Qualcomm QCA 9379', 'Qualcomm Qualcomm APQ 8096AU', 'Qualcomm SDA 845', 'Qualcomm SDM 636', 'Qualcomm SDM 845', 'Qualcomm SM 8150', 'Qualcomm MSM 8905', 'Qualcomm MDM 9207C', 'Qualcomm QCN 7605', 'Qualcomm Qualcomm APQ 8009', 'Qualcomm Qualcomm APQ 8017', 'Qualcomm Qualcomm APQ 8053', 'Qualcomm Qualcomm APQ 8064']

Name

['Qualcomm MDM 9607', 'Qualcomm MDM 9650', 'Qualcomm MSM 8996AU', 'Qualcomm QCS 605', 'Qualcomm SDA 660', 'Qualcomm SDM 660', 'Qualcomm SDX 24', 'Qualcomm QCS 405', 'Qualcomm SDX 20', 'Qualcomm MDM 9206', 'Qualcomm QCA 6574AU', 'Qualcomm IPQ 4019', 'Qualcomm IPQ 8064', 'Qualcomm IPQ 8074', 'Qualcomm MDM 9640', 'Qualcomm QCA 6174A', 'Qualcomm QCA 9377', 'Qualcomm QCA 9379', 'Qualcomm Qualcomm APQ 8096AU', 'Qualcomm SDA 845', 'Qualcomm SDM 636', 'Qualcomm SDM 845', 'Qualcomm SM 8150', 'Qualcomm MSM 8905', 'Qualcomm MDM 9207C', 'Qualcomm QCN 7605', 'Qualcomm Qualcomm APQ 8009', 'Qualcomm Qualcomm APQ 8017', 'Qualcomm Qualcomm APQ 8053', 'Qualcomm Qualcomm APQ 8064']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-2297",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-2297"
    }
  },
  "description": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002MDM9607\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX24\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002\n\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684WLAN\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7f13\u51b2\u533a\u6ea2\u51fa\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-16064",
  "openTime": "2020-03-09",
  "patchDescription": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002MDM9607\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX24\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002\r\n\r\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684WLAN\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-16064\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Qualcomm MDM 9607",
      "Qualcomm MDM 9650",
      "Qualcomm MSM 8996AU",
      "Qualcomm QCS 605",
      "Qualcomm SDA 660",
      "Qualcomm SDM 660",
      "Qualcomm SDX 24",
      "Qualcomm QCS 405",
      "Qualcomm SDX 20",
      "Qualcomm MDM 9206",
      "Qualcomm QCA 6574AU",
      "Qualcomm IPQ 4019",
      "Qualcomm IPQ 8064",
      "Qualcomm IPQ 8074",
      "Qualcomm MDM 9640",
      "Qualcomm QCA 6174A",
      "Qualcomm QCA 9377",
      "Qualcomm QCA 9379",
      "Qualcomm Qualcomm APQ 8096AU",
      "Qualcomm SDA 845",
      "Qualcomm SDM 636",
      "Qualcomm SDM 845",
      "Qualcomm SM 8150",
      "Qualcomm MSM 8905",
      "Qualcomm MDM 9207C",
      "Qualcomm QCN 7605",
      "Qualcomm Qualcomm APQ 8009",
      "Qualcomm Qualcomm APQ 8017",
      "Qualcomm Qualcomm APQ 8053",
      "Qualcomm Qualcomm APQ 8064"
    ]
  },
  "referenceLink": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin",
  "serverity": "\u4e2d",
  "submitTime": "2019-11-19",
  "title": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-16064\uff09"
}

CVE-2019-2297 (GCVE-0-2019-2297)

Vulnerability from cvelistv5

Published

2019-11-21 14:38

Modified

2024-08-04 18:42

Severity ?

CWE

Integer Overflow to Buffer Overflow in WLAN

Summary

Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150

References

▼	URL	Tags
	https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Qualcomm, Inc.	Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking	Version: APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:42:51.188Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Integer Overflow to Buffer Overflow in WLAN",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-21T14:38:22",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@qualcomm.com",
          "ID": "CVE-2019-2297",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Qualcomm, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Integer Overflow to Buffer Overflow in WLAN"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin",
              "refsource": "CONFIRM",
              "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2019-2297",
    "datePublished": "2019-11-21T14:38:22",
    "dateReserved": "2018-12-10T00:00:00",
    "dateUpdated": "2024-08-04T18:42:51.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted