CVE-2020-3676 - Possible memory corruption in perfservice due to improper validation array length taken from user application

Back Back to CVE browser

HIGH

Possible memory corruption in perfservice due to improper validation array length taken from user application

Published Jun 22, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.21%

Description

Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, Kamorta, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Affected products

Vendor Qualcomm, Inc. Product n/a Default
n/a
- Version
  APQ8096AU, APQ8098, Kamorta, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Qualcomm, Inc.

n/a

Version	Status	Constraints
APQ8096AU, APQ8098, Kamorta, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-787

Out-of-bounds Write

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24947
Advisory
https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
x_refsource_CONFIRMBroken Link
https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24947		Advisory
https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin		x_refsource_CONFIRMBroken Link
https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin		Vendor Advisory