CVE-2019-2304
Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8917, MSM8920, MSM8937, MSM8940, QCN7605, QCS405, QCS605, SDA845, SDM660, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.22% probability · 12th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-190, CWE-787
- Affected
- qualcomm/ipq4019 firmware · qualcomm/ipq8064 firmware · qualcomm/ipq8074 firmware · qualcomm/mdm9607 firmware · qualcomm/msm8917 firmware · qualcomm/msm8920 firmware · qualcomm/msm8937 firmware · qualcomm/msm8940 firmware · qualcomm/qcn7605 firmware · qualcomm/qcs405 firmware · qualcomm/qcs605 firmware · qualcomm/sda845 firmware · qualcomm/sdm660 firmware · qualcomm/sdm845 firmware · qualcomm/sdx24 firmware · qualcomm/sdx55 firmware · qualcomm/sm6150 firmware · qualcomm/sm7150 firmware · qualcomm/sm8150 firmware · qualcomm/sxr1130 firmware
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.