Details of VAR-201909-1457

ID

VAR-201909-1457

CVE

CVE-2019-10506

TITLE

plural Snapdragon Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-010012

DESCRIPTION

While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY vendor command, driver does not validate the data obtained from the user space which could be invalid and thus leads to an undesired behaviour in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24. plural Snapdragon The product contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. SDX24 is a modem. An input validation error vulnerability exists in WLAN in several Qualcomm products. The vulnerability stems from the failure of the network system or product to properly validate the input data

Trust: 1.71

sources: NVD: CVE-2019-10506 // JVNDB: JVNDB-2019-010012 // VULHUB: VHN-142059

AFFECTED PRODUCTS

vendor:	qualcomm	model:	qca9379	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8996au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx24	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 835	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 710	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 675	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 820a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9377	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 730	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 850	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9206	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm630	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6174a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 820	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm660	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 600	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 670	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 855	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 665	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 712	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 636	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd 625	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9206	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9607	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8996au	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qca6174a	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qca6574au	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qca9377	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qca9379	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcs605	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 600	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 625	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-010012 // NVD: CVE-2019-10506

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-10506
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-10506
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201909-168
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-142059
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-10506
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-142059
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-10506
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-10506
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-142059 // JVNDB: JVNDB-2019-010012 // CNNVD: CNNVD-201909-168 // NVD: CVE-2019-10506

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-142059 // JVNDB: JVNDB-2019-010012 // NVD: CVE-2019-10506

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201909-168

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-010012

PATCH

title:	August 2019 Code Aurora Security Bulletin	url:	https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin	Trust: 0.8
title:	Multiple Qualcomm Product input verification error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=97930	Trust: 0.6

sources: JVNDB: JVNDB-2019-010012 // CNNVD: CNNVD-201909-168

EXTERNAL IDS

db:	NVD	id:	CVE-2019-10506	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-010012	Trust: 0.8
db:	CNNVD	id:	CNNVD-201909-168	Trust: 0.7
db:	VULHUB	id:	VHN-142059	Trust: 0.1

sources: VULHUB: VHN-142059 // JVNDB: JVNDB-2019-010012 // CNNVD: CNNVD-201909-168 // NVD: CVE-2019-10506

REFERENCES

url:	https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10506	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10506	Trust: 0.8
url:	https://vigilance.fr/vulnerability/google-android-os-multiple-vulnerabilities-30243	Trust: 0.6

sources: VULHUB: VHN-142059 // JVNDB: JVNDB-2019-010012 // CNNVD: CNNVD-201909-168 // NVD: CVE-2019-10506

SOURCES

db:	VULHUB	id:	VHN-142059
db:	JVNDB	id:	JVNDB-2019-010012
db:	CNNVD	id:	CNNVD-201909-168
db:	NVD	id:	CVE-2019-10506

LAST UPDATE DATE

2024-11-23T21:51:57.653000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-142059	date:	2019-10-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-010012	date:	2019-10-03T00:00:00
db:	CNNVD	id:	CNNVD-201909-168	date:	2019-10-14T00:00:00
db:	NVD	id:	CVE-2019-10506	date:	2024-11-21T04:19:18.463

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-142059	date:	2019-09-30T00:00:00
db:	JVNDB	id:	JVNDB-2019-010012	date:	2019-10-03T00:00:00
db:	CNNVD	id:	CNNVD-201909-168	date:	2019-09-04T00:00:00
db:	NVD	id:	CVE-2019-10506	date:	2019-09-30T16:15:10.697