CVE-2019-14009

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, MDM9150, MDM9607, MDM9650, MSM8905, MSM8909, MSM8998, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845, SDM850, SXR2130

Un acceso a la memoria fuera de límites mientras se procesa el manejador de comandos TZ debido a una comprobación de entrada inapropiada en la longitud de la respuesta recibida del usuario en los productos Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking en versiones APQ8009, APQ8098, MDM9150, MDM9607, MDM9650, MSM8905, MSM8909, MSM8998, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845, SDM850, SXR2130

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-07-19 CVE Reserved
2020-04-16 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin	2020-04-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Qualcomm Search vendor "Qualcomm"	Apq8009 Firmware Search vendor "Qualcomm" for product "Apq8009 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Apq8009 Search vendor "Qualcomm" for product "Apq8009"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Apq8098 Firmware Search vendor "Qualcomm" for product "Apq8098 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Apq8098 Search vendor "Qualcomm" for product "Apq8098"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Mdm9150 Firmware Search vendor "Qualcomm" for product "Mdm9150 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Mdm9150 Search vendor "Qualcomm" for product "Mdm9150"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Mdm9607 Firmware Search vendor "Qualcomm" for product "Mdm9607 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Mdm9607 Search vendor "Qualcomm" for product "Mdm9607"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Mdm9650 Firmware Search vendor "Qualcomm" for product "Mdm9650 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Mdm9650 Search vendor "Qualcomm" for product "Mdm9650"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Msm8905 Firmware Search vendor "Qualcomm" for product "Msm8905 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Msm8905 Search vendor "Qualcomm" for product "Msm8905"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Msm8909 Firmware Search vendor "Qualcomm" for product "Msm8909 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Msm8909 Search vendor "Qualcomm" for product "Msm8909"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Msm8998 Firmware Search vendor "Qualcomm" for product "Msm8998 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Msm8998 Search vendor "Qualcomm" for product "Msm8998"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sda660 Firmware Search vendor "Qualcomm" for product "Sda660 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sda660 Search vendor "Qualcomm" for product "Sda660"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sda845 Firmware Search vendor "Qualcomm" for product "Sda845 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sda845 Search vendor "Qualcomm" for product "Sda845"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm630 Firmware Search vendor "Qualcomm" for product "Sdm630 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm630 Search vendor "Qualcomm" for product "Sdm630"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm636 Firmware Search vendor "Qualcomm" for product "Sdm636 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm636 Search vendor "Qualcomm" for product "Sdm636"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm660 Firmware Search vendor "Qualcomm" for product "Sdm660 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm660 Search vendor "Qualcomm" for product "Sdm660"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm845 Firmware Search vendor "Qualcomm" for product "Sdm845 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm845 Search vendor "Qualcomm" for product "Sdm845"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sdm850 Firmware Search vendor "Qualcomm" for product "Sdm850 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sdm850 Search vendor "Qualcomm" for product "Sdm850"	-	-	Safe
Qualcomm Search vendor "Qualcomm"	Sxr2130 Firmware Search vendor "Qualcomm" for product "Sxr2130 Firmware"	-	-	Affected	in	Qualcomm Search vendor "Qualcomm"	Sxr2130 Search vendor "Qualcomm" for product "Sxr2130"	-	-	Safe