Lack of input validation for data received from user space can lead to OOB access in WLAN in Snapdragon Auto, Snapdragon Consumer Electronic

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• qualcomm mdm9150 firmwareall versions
• qualcomm mdm9206 firmwareall versions
• qualcomm mdm9607 firmwareall versions
• qualcomm mdm9640 firmwareall versions
• qualcomm mdm9650 firmwareall versions
• qualcomm msm8909w firmwareall versions
• qualcomm msm8996au firmwareall versions
• qualcomm qca6174a firmwareall versions
• qualcomm qca6574au firmwareall versions
• qualcomm qca9377 firmwareall versions
• qualcomm qca9379 firmwareall versions
• qualcomm sd 205 firmwareall versions
• qualcomm sd 210 firmwareall versions
• qualcomm sd 212 firmwareall versions
• qualcomm sd 415 firmwareall versions
• qualcomm sd 425 firmwareall versions
• qualcomm sd 430 firmwareall versions
• qualcomm sd 600 firmwareall versions
• qualcomm sd 615 firmwareall versions
• qualcomm sd 616 firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (qualcomm). Independent of NVD's CPE analysis and usually ahead of it.

• Qualcomm, Inc. Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  • MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 8affected

Other highest-scoring records for the same primary product.

• CVE-2019-2332Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdrag
  39Monitor
• CVE-2019-2331Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapd
  39Monitor
• CVE-2019-2325Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdra
  39Monitor
• CVE-2019-2324When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access
  39Monitor
• CVE-2019-2323Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Sna
  39Monitor
• CVE-2019-2283Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Aut
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.