CVE-2019-10496 — HIGH (7.8)

Vulnerability Description

Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qualcomm	Msm8909W Firmware	-
Qualcomm	Msm8909W	-
Qualcomm	Msm8996Au Firmware	-
Qualcomm	Msm8996Au	-
Qualcomm	Qcs605 Firmware	-
Qualcomm	Qcs605	-
Qualcomm	Qualcomm 215 Firmware	-
Qualcomm	Qualcomm 215	-
Qualcomm	Sd 210 Firmware	-
Qualcomm	Sd 210	-
Qualcomm	Sd 212 Firmware	-
Qualcomm	Sd 212	-
Qualcomm	Sd 205 Firmware	-
Qualcomm	Sd 205	-
Qualcomm	Sd 425 Firmware	-
Qualcomm	Sd 425	-
Qualcomm	Sd 427 Firmware	-
Qualcomm	Sd 427	-
Qualcomm	Sd 430 Firmware	-
Qualcomm	Sd 430	-

Related Weaknesses (CWE)

CWE-120

References

https://source.android.com/security/bulletin/Third Party Advisory
https://source.android.com/security/bulletin/Third Party Advisory

FAQ

What is CVE-2019-10496?

CVE-2019-10496 is a vulnerability with a CVSS score of 7.8 (HIGH). Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer...

How severe is CVE-2019-10496?

CVE-2019-10496 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-10496?

Check the references section above for vendor advisories and patch information. Affected products include: Qualcomm Msm8909W Firmware, Qualcomm Msm8909W, Qualcomm Msm8996Au Firmware, Qualcomm Msm8996Au, Qualcomm Qcs605 Firmware.