cnvd - cnvd-2020-20201

cnvd-2020-20201

Vulnerability from cnvd

Title: 多款Qualcomm产品输入验证错误漏洞（CNVD-2020-20201）

Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。SDX24是一款调制解调器。APQ8017是一款中央处理器（CPU）产品。

多款Qualcomm产品中的Data Modem存在输入验证错误漏洞，攻击者可借助特制的请求利用该漏洞在系统上执行任意代码。

Severity: 高

Patch Name: 多款Qualcomm产品输入验证错误漏洞（CNVD-2020-20201）的补丁

Patch Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。SDX24是一款调制解调器。APQ8017是一款中央处理器（CPU）产品。

多款Qualcomm产品中的Data Modem存在输入验证错误漏洞，攻击者可借助特制的请求利用该漏洞在系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin

Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-10593

Impacted products

Name
['Qualcomm MDM9206', 'Qualcomm MDM9607', 'Qualcomm MSM8909W', 'Qualcomm MSM8996AU', 'Qualcomm SDX20', 'Qualcomm SDM429', 'Qualcomm SDM439', 'Qualcomm SDM632', 'Qualcomm SDM636', 'Qualcomm SDM660', 'Qualcomm SDA660', 'Qualcomm SDA845', 'Qualcomm SDX24', 'Qualcomm SXR1130', 'Qualcomm MDM9645', 'Qualcomm MDM9650', 'Qualcomm MDM9655', 'Qualcomm MDM9150', 'Qualcomm QCS605', 'Qualcomm MDM9640', 'Qualcomm SDM630', 'Qualcomm Nicobar', 'Qualcomm APQ8009', 'Qualcomm SM7150', 'Qualcomm SDM670', 'Qualcomm SM8150', 'Qualcomm SDM429W', 'Qualcomm APQ8017', 'Qualcomm APQ8053', 'Qualcomm APQ8096AU', 'Qualcomm MSM8917', 'Qualcomm MSM8920', 'Qualcomm MSM8937', 'Qualcomm MSM8940', 'Qualcomm MSM8953', 'Qualcomm SC8180X', 'Qualcomm SDM450', 'Qualcomm SDX55', 'Qualcomm APQ8098', 'Qualcomm MSM8905', 'Qualcomm MSM8909', 'Qualcomm MSM8998', 'Qualcomm QM215', 'Qualcomm Rennell', 'Qualcomm QCM2150', 'Qualcomm SDM710', 'Qualcomm SDM845', 'Qualcomm SDM850', 'Qualcomm SM6150', 'Qualcomm APQ8096', 'Qualcomm APQ8076']

Name

['Qualcomm MDM9206', 'Qualcomm MDM9607', 'Qualcomm MSM8909W', 'Qualcomm MSM8996AU', 'Qualcomm SDX20', 'Qualcomm SDM429', 'Qualcomm SDM439', 'Qualcomm SDM632', 'Qualcomm SDM636', 'Qualcomm SDM660', 'Qualcomm SDA660', 'Qualcomm SDA845', 'Qualcomm SDX24', 'Qualcomm SXR1130', 'Qualcomm MDM9645', 'Qualcomm MDM9650', 'Qualcomm MDM9655', 'Qualcomm MDM9150', 'Qualcomm QCS605', 'Qualcomm MDM9640', 'Qualcomm SDM630', 'Qualcomm Nicobar', 'Qualcomm APQ8009', 'Qualcomm SM7150', 'Qualcomm SDM670', 'Qualcomm SM8150', 'Qualcomm SDM429W', 'Qualcomm APQ8017', 'Qualcomm APQ8053', 'Qualcomm APQ8096AU', 'Qualcomm MSM8917', 'Qualcomm MSM8920', 'Qualcomm MSM8937', 'Qualcomm MSM8940', 'Qualcomm MSM8953', 'Qualcomm SC8180X', 'Qualcomm SDM450', 'Qualcomm SDX55', 'Qualcomm APQ8098', 'Qualcomm MSM8905', 'Qualcomm MSM8909', 'Qualcomm MSM8998', 'Qualcomm QM215', 'Qualcomm Rennell', 'Qualcomm QCM2150', 'Qualcomm SDM710', 'Qualcomm SDM845', 'Qualcomm SDM850', 'Qualcomm SM6150', 'Qualcomm APQ8096', 'Qualcomm APQ8076']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-10593"
    }
  },
  "description": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX24\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002APQ8017\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002\n\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684Data Modem\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-20201",
  "openTime": "2020-03-30",
  "patchDescription": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX24\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002APQ8017\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684Data Modem\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-20201\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Qualcomm MDM9206",
      "Qualcomm MDM9607",
      "Qualcomm MSM8909W",
      "Qualcomm MSM8996AU",
      "Qualcomm SDX20",
      "Qualcomm SDM429",
      "Qualcomm SDM439",
      "Qualcomm SDM632",
      "Qualcomm SDM636",
      "Qualcomm SDM660",
      "Qualcomm SDA660",
      "Qualcomm SDA845",
      "Qualcomm SDX24",
      "Qualcomm SXR1130",
      "Qualcomm MDM9645",
      "Qualcomm MDM9650",
      "Qualcomm MDM9655",
      "Qualcomm MDM9150",
      "Qualcomm QCS605",
      "Qualcomm MDM9640",
      "Qualcomm SDM630",
      "Qualcomm Nicobar",
      "Qualcomm APQ8009",
      "Qualcomm SM7150",
      "Qualcomm SDM670",
      "Qualcomm SM8150",
      "Qualcomm SDM429W",
      "Qualcomm APQ8017",
      "Qualcomm APQ8053",
      "Qualcomm APQ8096AU",
      "Qualcomm MSM8917",
      "Qualcomm MSM8920",
      "Qualcomm MSM8937",
      "Qualcomm MSM8940",
      "Qualcomm MSM8953",
      "Qualcomm SC8180X",
      "Qualcomm SDM450",
      "Qualcomm SDX55",
      "Qualcomm APQ8098",
      "Qualcomm MSM8905",
      "Qualcomm MSM8909",
      "Qualcomm MSM8998",
      "Qualcomm QM215",
      "Qualcomm Rennell",
      "Qualcomm QCM2150",
      "Qualcomm SDM710",
      "Qualcomm SDM845",
      "Qualcomm SDM850",
      "Qualcomm SM6150",
      "Qualcomm APQ8096",
      "Qualcomm APQ8076"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-10593",
  "serverity": "\u9ad8",
  "submitTime": "2020-03-04",
  "title": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-20201\uff09"
}

CVE-2019-10593 (GCVE-0-2019-10593)

Vulnerability from cvelistv5

Published

2020-03-05 08:56

Modified

2024-08-04 22:24

Severity ?

CWE

Improper Validation of Array Index in Data Modem

Summary

Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\VOLTE call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

References

▼	URL	Tags
	https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables	Version: APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:24:18.818Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\\VOLTE call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Validation of Array Index in Data Modem",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-05T08:56:07",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@qualcomm.com",
          "ID": "CVE-2019-10593",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Qualcomm, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\\VOLTE call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Validation of Array Index in Data Modem"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin",
              "refsource": "CONFIRM",
              "url": "https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2019-10593",
    "datePublished": "2020-03-05T08:56:08",
    "dateReserved": "2019-03-29T00:00:00",
    "dateUpdated": "2024-08-04T22:24:18.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted