VulnerabilityModified
CVE-2020-11230
Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT,…
MEDIUM 6.4EPSS 0.14%
Does this matter?
Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.
Description
Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- CVSS 3.1
- 6.4 MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.14% probability · 3th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-367
- Affected
- qualcomm/aqt1000 firmware · qualcomm/fsm10055 firmware · qualcomm/pm3003a firmware · qualcomm/pm7150a firmware · qualcomm/pm7150l firmware · qualcomm/pm7250 firmware · qualcomm/pm7250b firmware · qualcomm/pm7350c firmware · qualcomm/pm8004 firmware · qualcomm/pm8008 firmware · qualcomm/pm8009 firmware · qualcomm/pm8150a firmware · qualcomm/pm8150b firmware · qualcomm/pm8150c firmware · qualcomm/pm8150l firmware · qualcomm/pm8250 firmware · qualcomm/pm8350 firmware · qualcomm/pm8350b firmware · qualcomm/pm8350bh firmware · qualcomm/pm8350bhs firmware · +40 more
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.