CVE-2020-11201

Published: Nov 12, 2020Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCM6125, QCS410, QCS603, QCS605, QCS610, QCS6125, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDA640, SDA845, SDM640, SDM830, SDM845, SDX50M, SDX55, SDX55M, SM6125, SM6150, SM6250, SM6250P, SM7125, SM7150, SM7150P, SM8150, SM8150P

Affected (28)

Products: Qualcomm: Qcm6125 Firmware, Qcs410 Firmware, Qcs603 Firmware, Qcs605 Firmware, Qcs610 Firmware, Qcs6125 Firmware, Sa6145p Firmware, Sa6155 Firmware, Sa6155p Firmware, Sa8155 Firmware, Sa8155p Firmware, Sda640 Firmware, Sda845 Firmware, Sdm640 Firmware, Sdm830 Firmware, Sdm845 Firmware, Sdx50m Firmware, Sdx55 Firmware, Sdx55m Firmware, Sm6125 Firmware, Sm6150 Firmware, Sm6250 Firmware, Sm6250p Firmware, Sm7125 Firmware, Sm7150 Firmware, Sm7150p Firmware, Sm8150 Firmware, Sm8150p Firmware

28 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Qcm6125 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Qcm6125	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Qcs410 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Qcs410	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Qcs603 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Qcs603	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Qcs605 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Qcs605	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Qcs610 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Qcs610	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Qcs6125 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Qcs6125	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sa6145p Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sa6145p	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sa6155 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sa6155	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sa6155p Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sa6155p	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sa8155 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sa8155	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sa8155p Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sa8155p	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sda640 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sda640	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sda845 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sda845	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdm640 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdm640	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdm830 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdm830	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdm845 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdm845	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdx50m Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdx50m	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdx55 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdx55	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sdx55m Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sdx55m	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm6125 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm6125	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm6150 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm6150	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm6250 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm6250	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm6250p Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm6250p	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm7125 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm7125	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm7150 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm7150	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm7150p Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm7150p	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm8150 Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm8150	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qualcomm Sm8150p Firmware	All versions

Running on/with	Platform Versions
Qualcomm Sm8150p	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

Source: product-security@qualcomm.com

Third Party Advisory

https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/

Source: product-security@qualcomm.com

ExploitThird Party Advisory

https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin

Source: product-security@qualcomm.com

Broken LinkVendor Advisory

https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

Timeline

No history available yet.