Details of VAR-202001-1493

ID

VAR-202001-1493

CVE

CVE-2019-10548

TITLE

plural Snapdragon Products use free memory vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-014198

DESCRIPTION

While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same time in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SXR1130. plural Snapdragon The product contains a vulnerability related to the use of freed memory.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Qualcomm MSM8996AU, etc. are all a central processing unit (CPU) product of Qualcomm. HLOS Data in many Qualcomm products has a resource management error vulnerability. Local attackers can use this vulnerability to execute arbitrary code or cause a denial of service by sending a specially crafted request

Trust: 2.25

sources: NVD: CVE-2019-10548 // JVNDB: JVNDB-2019-014198 // CNVD: CNVD-2020-41778 // VULMON: CVE-2019-10548

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-41778

AFFECTED PRODUCTS

vendor:	qualcomm	model:	msm8909w	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	apq8009	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	apq8053	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	apq8096au	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8917	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8920	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8937	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8905	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8909	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8939	scope:	-	version:	-	Trust: 1.4
vendor:	qualcomm	model:	msm8909	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8053	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8953	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm636	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm8150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8917	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8096au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8996au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8998	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm429	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8009	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm7150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm6150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sda660	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm632	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm429w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm670	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm450	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm710	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm630	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm660	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qm215	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm439	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	nicobar	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8909w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8905	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8920	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8940	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr1130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8937	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8939	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm429	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm630	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm632	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm636	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm660	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	msm8996au	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sda660	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sxr1130	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm439	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	qcs605	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sm7150	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	qca6574au	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	nicobar	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm670	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sm8150	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm429w	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	msm8940	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	msm8953	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm450	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	msm8998	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	qm215	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm710	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sdm845	scope:	-	version:	-	Trust: 0.6
vendor:	qualcomm	model:	sm6150	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-41778 // JVNDB: JVNDB-2019-014198 // NVD: CVE-2019-10548

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-10548
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-10548
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-41778
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202001-207
value:	HIGH
Trust: 0.6
VULMON:	CVE-2019-10548
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-10548
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-41778
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-10548
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-10548
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-41778 // VULMON: CVE-2019-10548 // JVNDB: JVNDB-2019-014198 // CNNVD: CNNVD-202001-207 // NVD: CVE-2019-10548

PROBLEMTYPE DATA

problemtype:

CWE-416

Trust: 1.8

sources: JVNDB: JVNDB-2019-014198 // NVD: CVE-2019-10548

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202001-207

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202001-207

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-014198

PATCH

title:	January 2020 Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin	Trust: 0.8
title:	Patch for Resource management error vulnerabilities in multiple Qualcomm products (CNVD-2020-41778)	url:	https://www.cnvd.org.cn/patchInfo/show/226747	Trust: 0.6
title:	Multiple Qualcomm Product resource management error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=108335	Trust: 0.6

sources: CNVD: CNVD-2020-41778 // JVNDB: JVNDB-2019-014198 // CNNVD: CNNVD-202001-207

EXTERNAL IDS

db:	NVD	id:	CVE-2019-10548	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-014198	Trust: 0.8
db:	CNVD	id:	CNVD-2020-41778	Trust: 0.6
db:	CNNVD	id:	CNNVD-202001-207	Trust: 0.6
db:	VULMON	id:	CVE-2019-10548	Trust: 0.1

sources: CNVD: CNVD-2020-41778 // VULMON: CVE-2019-10548 // JVNDB: JVNDB-2019-014198 // CNNVD: CNNVD-202001-207 // NVD: CVE-2019-10548

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10548	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10548	Trust: 0.8
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-january-2020-31267	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/416.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-41778 // VULMON: CVE-2019-10548 // JVNDB: JVNDB-2019-014198 // CNNVD: CNNVD-202001-207 // NVD: CVE-2019-10548

SOURCES

db:	CNVD	id:	CNVD-2020-41778
db:	VULMON	id:	CVE-2019-10548
db:	JVNDB	id:	JVNDB-2019-014198
db:	CNNVD	id:	CNNVD-202001-207
db:	NVD	id:	CVE-2019-10548

LAST UPDATE DATE

2024-11-23T23:11:35.031000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-41778	date:	2020-07-23T00:00:00
db:	VULMON	id:	CVE-2019-10548	date:	2020-01-23T00:00:00
db:	JVNDB	id:	JVNDB-2019-014198	date:	2020-02-06T00:00:00
db:	CNNVD	id:	CNNVD-202001-207	date:	2020-05-15T00:00:00
db:	NVD	id:	CVE-2019-10548	date:	2024-11-21T04:19:25.520

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-41778	date:	2020-07-23T00:00:00
db:	VULMON	id:	CVE-2019-10548	date:	2020-01-21T00:00:00
db:	JVNDB	id:	JVNDB-2019-014198	date:	2020-02-06T00:00:00
db:	CNNVD	id:	CNNVD-202001-207	date:	2020-01-07T00:00:00
db:	NVD	id:	CVE-2019-10548	date:	2020-01-21T07:15:11.353