u'Out of bound memory access if stack push and pop operation are performed without doing a bound check on stack top' in Snapdragon Auto, Sna

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• qualcomm bitra firmwareall versions
• qualcomm ipq6018 firmwareall versions
• qualcomm ipq8074 firmwareall versions
• qualcomm mdm9205 firmwareall versions
• qualcomm nicobar firmwareall versions
• qualcomm qca8081 firmwareall versions
• qualcomm qcn7605 firmwareall versions
• qualcomm qcs404 firmwareall versions
• qualcomm qcs405 firmwareall versions
• qualcomm qcs605 firmwareall versions
• qualcomm qcs610 firmwareall versions
• qualcomm rennell firmwareall versions
• qualcomm sa415m firmwareall versions
• qualcomm sa6155p firmwareall versions
• qualcomm saipan firmwareall versions
• qualcomm sc7180 firmwareall versions
• qualcomm sc8180x firmwareall versions
• qualcomm sda845 firmwareall versions
• qualcomm sdm670 firmwareall versions
• qualcomm sdm710 firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (qualcomm). Independent of NVD's CPE analysis and usually ahead of it.

• Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Mu

  • Bitra, IPQ6018, IPQ8074, MDM9205, Nicobar, QCA8081, QCN7605, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDaffected

Other highest-scoring records for the same primary product.

• CVE-2020-3694u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom' in Snapdragon Auto, Snapdrag
  31Monitor
• CVE-2020-11129u'During the error occurrence in capture request, the buffer is freed and later accessed causing the camera APP to fail due to memory use-af
  31Monitor
• CVE-2020-3646u'Buffer overflow seen as the destination buffer size is lesser than the source buffer size in video application' in Snapdragon Compute, Sna
  31Monitor

Published before and after this one in the same product

• ← EarlierCVE-2019-10596Sep 8, 2020 · u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdr
  31Monitor
• ← EarlierCVE-2019-10629Sep 8, 2020 · u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdra
  31Monitor
• Later →CVE-2019-14117Sep 8, 2020 · u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which result
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.