cnvd - cnvd-2020-16064

CNVD-2020-16064

Vulnerability from cnvd - Published: 2020-03-09

Title

多款Qualcomm产品缓冲区溢出漏洞（CNVD-2020-16064）

Description

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。MDM9607是一款中央处理器（CPU）产品。SDX24是一款调制解调器。多款Qualcomm产品中的WLAN存在安全漏洞。攻击者可利用该漏洞造成缓冲区溢出。

Severity

中

Patch Name

多款Qualcomm产品缓冲区溢出漏洞（CNVD-2020-16064）的补丁

Patch Description

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。MDM9607是一款中央处理器（CPU）产品。SDX24是一款调制解调器。多款Qualcomm产品中的WLAN存在安全漏洞。攻击者可利用该漏洞造成缓冲区溢出。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin

Reference

https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin

Impacted products

Name
['Qualcomm MDM 9607', 'Qualcomm MDM 9650', 'Qualcomm MSM 8996AU', 'Qualcomm QCS 605', 'Qualcomm SDA 660', 'Qualcomm SDM 660', 'Qualcomm SDX 24', 'Qualcomm QCS 405', 'Qualcomm SDX 20', 'Qualcomm MDM 9206', 'Qualcomm QCA 6574AU', 'Qualcomm IPQ 4019', 'Qualcomm IPQ 8064', 'Qualcomm IPQ 8074', 'Qualcomm MDM 9640', 'Qualcomm QCA 6174A', 'Qualcomm QCA 9377', 'Qualcomm QCA 9379', 'Qualcomm Qualcomm APQ 8096AU', 'Qualcomm SDA 845', 'Qualcomm SDM 636', 'Qualcomm SDM 845', 'Qualcomm SM 8150', 'Qualcomm MSM 8905', 'Qualcomm MDM 9207C', 'Qualcomm QCN 7605', 'Qualcomm Qualcomm APQ 8009', 'Qualcomm Qualcomm APQ 8017', 'Qualcomm Qualcomm APQ 8053', 'Qualcomm Qualcomm APQ 8064']

Name

['Qualcomm MDM 9607', 'Qualcomm MDM 9650', 'Qualcomm MSM 8996AU', 'Qualcomm QCS 605', 'Qualcomm SDA 660', 'Qualcomm SDM 660', 'Qualcomm SDX 24', 'Qualcomm QCS 405', 'Qualcomm SDX 20', 'Qualcomm MDM 9206', 'Qualcomm QCA 6574AU', 'Qualcomm IPQ 4019', 'Qualcomm IPQ 8064', 'Qualcomm IPQ 8074', 'Qualcomm MDM 9640', 'Qualcomm QCA 6174A', 'Qualcomm QCA 9377', 'Qualcomm QCA 9379', 'Qualcomm Qualcomm APQ 8096AU', 'Qualcomm SDA 845', 'Qualcomm SDM 636', 'Qualcomm SDM 845', 'Qualcomm SM 8150', 'Qualcomm MSM 8905', 'Qualcomm MDM 9207C', 'Qualcomm QCN 7605', 'Qualcomm Qualcomm APQ 8009', 'Qualcomm Qualcomm APQ 8017', 'Qualcomm Qualcomm APQ 8053', 'Qualcomm Qualcomm APQ 8064']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-2297",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-2297"
    }
  },
  "description": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002MDM9607\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX24\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002\n\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684WLAN\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7f13\u51b2\u533a\u6ea2\u51fa\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-16064",
  "openTime": "2020-03-09",
  "patchDescription": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002MDM9607\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX24\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002\r\n\r\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684WLAN\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-16064\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Qualcomm MDM 9607",
      "Qualcomm MDM 9650",
      "Qualcomm MSM 8996AU",
      "Qualcomm QCS 605",
      "Qualcomm SDA 660",
      "Qualcomm SDM 660",
      "Qualcomm SDX 24",
      "Qualcomm QCS 405",
      "Qualcomm SDX 20",
      "Qualcomm MDM 9206",
      "Qualcomm QCA 6574AU",
      "Qualcomm IPQ 4019",
      "Qualcomm IPQ 8064",
      "Qualcomm IPQ 8074",
      "Qualcomm MDM 9640",
      "Qualcomm QCA 6174A",
      "Qualcomm QCA 9377",
      "Qualcomm QCA 9379",
      "Qualcomm Qualcomm APQ 8096AU",
      "Qualcomm SDA 845",
      "Qualcomm SDM 636",
      "Qualcomm SDM 845",
      "Qualcomm SM 8150",
      "Qualcomm MSM 8905",
      "Qualcomm MDM 9207C",
      "Qualcomm QCN 7605",
      "Qualcomm Qualcomm APQ 8009",
      "Qualcomm Qualcomm APQ 8017",
      "Qualcomm Qualcomm APQ 8053",
      "Qualcomm Qualcomm APQ 8064"
    ]
  },
  "referenceLink": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin",
  "serverity": "\u4e2d",
  "submitTime": "2019-11-19",
  "title": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-16064\uff09"
}

CVE-2019-2297 (GCVE-0-2019-2297)

Vulnerability from cvelistv5 – Published: 2019-11-21 14:38 – Updated: 2024-08-04 18:42

Summary

Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150

Severity ?

No CVSS data available.

CWE

Integer Overflow to Buffer Overflow in WLAN

Assigner

qualcomm

References

URL

Tags

https://www.qualcomm.com/company/product-security…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Qualcomm, Inc.	Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking	Affected: APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:42:51.188Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Integer Overflow to Buffer Overflow in WLAN",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-21T14:38:22",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@qualcomm.com",
          "ID": "CVE-2019-2297",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Qualcomm, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Integer Overflow to Buffer Overflow in WLAN"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin",
              "refsource": "CONFIRM",
              "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2019-2297",
    "datePublished": "2019-11-21T14:38:22",
    "dateReserved": "2018-12-10T00:00:00",
    "dateUpdated": "2024-08-04T18:42:51.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-16064

CVE-2019-2297 (GCVE-0-2019-2297)

Tags

Sightings

Nomenclature