ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• qualcomm ipq8074 firmwareall versions
• qualcomm mdm9150 firmwareall versions
• qualcomm mdm9206 firmwareall versions
• qualcomm mdm9607 firmwareall versions
• qualcomm mdm9650 firmwareall versions
• qualcomm mdm9655 firmwareall versions
• qualcomm msm8909w firmwareall versions
• qualcomm msm8996au firmwareall versions
• qualcomm qca8081 firmwareall versions
• qualcomm qcs605 firmwareall versions
• qualcomm qm215 firmwareall versions
• qualcomm sd 205 firmwareall versions
• qualcomm sd 210 firmwareall versions
• qualcomm sd 212 firmwareall versions
• qualcomm sd 410 firmwareall versions
• qualcomm sd 412 firmwareall versions
• qualcomm sd 415 firmwareall versions
• qualcomm sd 425 firmwareall versions
• qualcomm sd 427 firmwareall versions
• qualcomm sd 429 firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (qualcomm). Independent of NVD's CPE analysis and usually ahead of it.

• Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapd

  • IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 6affected

Other highest-scoring records for the same primary product.

• CVE-2019-14134Possible out of bound access in WLAN handler when the received value of length in rx path is shorter than the expected value of country IE i
  39Monitor
• CVE-2019-2249Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snap
  39Monitor
• CVE-2019-10540Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdrag
  39Monitor
• CVE-2019-10539Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Com
  39Monitor
• CVE-2018-13924Lack of check to prevent the buffer length taking negative values can lead to stack overflow.
  39Monitor
• CVE-2019-14082Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer El
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.