Details of VAR-202106-0149

ID

VAR-202106-0149

CVE

CVE-2020-11233

TITLE

plural Qualcomm In the product Time-of-check Time-of-use (TOCTOU) Race condition vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2021-007698

DESCRIPTION

Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables. plural Qualcomm The product has Time-of-check Time-of-use (TOCTOU) There is a race condition vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Trust: 1.62

sources: NVD: CVE-2020-11233 // JVNDB: JVNDB-2021-007698

AFFECTED PRODUCTS

vendor:	qualcomm	model:	qfe1045	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmd9635	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmd9655	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9630	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8096au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8937	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb358s	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qsw8573	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8909	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8009w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe1040	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9367	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8810	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qln1021aq	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb1358	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb231	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe3335	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb1360	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3680b	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9640	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8909w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3615	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8053	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe3320	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6174	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm660	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb1350	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9335	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmd9645	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8815	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wtr2955	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcc1110	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm439	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qet4200aq	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	rgr7640au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3620	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8953	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9230	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe1035	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8996	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wtr5975	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9628	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9377	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx20m	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8009	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe2340	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdw2500	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qtc801s	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9326	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6564a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8916	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb1357	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmi8937	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8937	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qln1036aq	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3680	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wtr2965	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8952	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8956	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmk8001	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qet4100	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb1355	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9250	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmi632	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3660b	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	csr6030	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx20	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd439	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe3100	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm215	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9330	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmi8994	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6564au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pm8004	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3610	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd820	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9330	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca4020	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wtr3905	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8996au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9306	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmm8996au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qualcomm215	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	smb1351	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wgr7640	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wtr4905	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6584	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9650	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9655	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8076	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd210	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdw3100	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qet4101	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6174a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8017	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmx20	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9379	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd205	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcc112	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmd9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qln1031	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmi8952	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9206	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	pmi8996	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wtr3925	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9626	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe3345	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qfe2550	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qln1030	scope:	eq	version:	-	Trust: 1.0
vendor:	クアルコム	model:	mdm9250	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8009	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8076	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8053	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	csr6030	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8017	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8009w	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	mdm9230	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	mdm9206	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8096au	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-007698 // NVD: CVE-2020-11233

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-11233
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-11233
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202101-069
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-11233
severity:	MEDIUM
baseScore:	6.9
vectorString:	AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.4
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2020-11233
baseSeverity:	HIGH
baseScore:	7.0
vectorString:	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.0
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2020-11233
baseSeverity:	HIGH
baseScore:	7.0
vectorString:	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2021-007698 // CNNVD: CNNVD-202101-069 // NVD: CVE-2020-11233

PROBLEMTYPE DATA

problemtype:	CWE-367	Trust: 1.0
problemtype:	Time-of-check Time-of-use (TOCTOU) Race condition (CWE-367) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-007698 // NVD: CVE-2020-11233

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202101-069

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202101-069

PATCH

title:	January 2021 Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin	Trust: 0.8
title:	Qualcomm Automotive Telematics Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138332	Trust: 0.6

sources: JVNDB: JVNDB-2021-007698 // CNNVD: CNNVD-202101-069

EXTERNAL IDS

db:	NVD	id:	CVE-2020-11233	Trust: 3.2
db:	JVNDB	id:	JVNDB-2021-007698	Trust: 0.8
db:	CNNVD	id:	CNNVD-202101-069	Trust: 0.6

sources: JVNDB: JVNDB-2021-007698 // CNNVD: CNNVD-202101-069 // NVD: CVE-2020-11233

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-11233	Trust: 0.8
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-january-2021-34240	Trust: 0.6

sources: JVNDB: JVNDB-2021-007698 // CNNVD: CNNVD-202101-069 // NVD: CVE-2020-11233

SOURCES

db:	JVNDB	id:	JVNDB-2021-007698
db:	CNNVD	id:	CNNVD-202101-069
db:	NVD	id:	CVE-2020-11233

LAST UPDATE DATE

2024-08-14T13:43:32.519000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2021-007698	date:	2022-02-21T08:17:00
db:	CNNVD	id:	CNNVD-202101-069	date:	2021-08-12T00:00:00
db:	NVD	id:	CVE-2020-11233	date:	2021-06-11T17:04:23.877

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2021-007698	date:	2022-02-21T00:00:00
db:	CNNVD	id:	CNNVD-202101-069	date:	2021-01-04T00:00:00
db:	NVD	id:	CVE-2020-11233	date:	2021-06-09T05:15:07.280