u'Buffer Overflow in mic calculation for WPA due to copying data into buffer without validating the length of buffer' in Snapdragon Auto, Sn

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• qualcomm apq8098 firmwareall versions
• qualcomm ipq5018 firmwareall versions
• qualcomm ipq6018 firmwareall versions
• qualcomm ipq8074 firmwareall versions
• qualcomm kamorta firmwareall versions
• qualcomm msm8998 firmwareall versions
• qualcomm nicobar firmwareall versions
• qualcomm qca6390 firmwareall versions
• qualcomm qca8081 firmwareall versions
• qualcomm qcs404 firmwareall versions
• qualcomm qcs405 firmwareall versions
• qualcomm qcs605 firmwareall versions
• qualcomm rennell firmwareall versions
• qualcomm sa415m firmwareall versions
• qualcomm saipan firmwareall versions
• qualcomm sc7180 firmwareall versions
• qualcomm sc8180x firmwareall versions
• qualcomm sda845 firmwareall versions
• qualcomm sdm630 firmwareall versions
• qualcomm sdm636 firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (qualcomm). Independent of NVD's CPE analysis and usually ahead of it.

• Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Netwo

  • APQ8098, IPQ5018, IPQ6018, IPQ8074, Kamorta, MSM8998, Nicobar, QCA6390, QCA8081, QCS404, QCS405, QCS605, Rennell, SA415M, Saipan, SC7180, SC8180X, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM84affected

Other highest-scoring records for the same primary product.

• CVE-2020-3669u'Buffer Overflow issue in WLAN tcp ip verification due to usage of out of range pointer offset' in Snapdragon Auto, Snapdragon Compute, Sna
  39Monitor
• CVE-2019-14112Potential buffer overflow while processing CBF frames due to lack of check of buffer length before copy in Snapdragon Auto, Snapdragon Compu
  39Monitor
• CVE-2019-14086Possible integer overflow while checking the length of frame which is a 32 bit integer and is added to another 32 bit integer which can lead
  39Monitor
• CVE-2020-11206Possible buffer overflow in Fastrpc while handling received parameters due to lack of validation on input parameters' in Snapdragon Auto, Sn
  32Monitor
• CVE-2020-3611u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon C
  31Monitor
• CVE-2019-10628u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto,
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.