CVE-2019-14010
The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical address in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical address in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, Rennell, SA6155P, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.66% probability · 50th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- qualcomm/mdm9607 firmware · qualcomm/nicobar firmware · qualcomm/rennell firmware · qualcomm/sa6155p firmware · qualcomm/sdm660 firmware · qualcomm/sdx55 firmware · qualcomm/sm6150 firmware · qualcomm/sm7150 firmware · qualcomm/sm8150 firmware · qualcomm/sm8250 firmware · qualcomm/sxr2130 firmware
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.