CVE-2020-11161
Out-of-bounds memory access can occur while calculating alignment requirements for a negative width from external components in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Out-of-bounds memory access can occur while calculating alignment requirements for a negative width from external components in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- qualcomm/apq8053 firmware · qualcomm/apq8064au firmware · qualcomm/apq8096au firmware · qualcomm/ar8031 firmware · qualcomm/ar8151 firmware · qualcomm/csra6620 firmware · qualcomm/csra6640 firmware · qualcomm/mdm9650 firmware · qualcomm/msm8996au firmware · qualcomm/pm215 firmware · qualcomm/pm3003a firmware · qualcomm/pm6125 firmware · qualcomm/pm6150 firmware · qualcomm/pm6150l firmware · qualcomm/pm670 firmware · qualcomm/pm670a firmware · qualcomm/pm670l firmware · qualcomm/pm7350c firmware · qualcomm/pm8005 firmware · qualcomm/pm8008 firmware · +40 more
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.