Vulnerabilities > CVE-2019-10603 - Use After Free vulnerability in Qualcomm products

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

qualcomm

CWE-416

NVD

Published: 2020-03-05

Updated: 2020-03-05

Summary

Use after free issue occurs If the real device interface goes down and a route lookup is performed while sending a raw IPv6 message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8937, MSM8996AU, QCN7605, SDA845, SDM630, SDM636, SDM660, SDX20, SXR1130

Vulnerable Configurations

Part	Description	Count
OS	Qualcomm Qualcomm Apq8053 Firmware - Qualcomm Apq8096Au Firmware - Qualcomm Apq8098 Firmware - Qualcomm Mdm9206 Firmware - Qualcomm Mdm9207C Firmware - Qualcomm Mdm9607 Firmware - Qualcomm Mdm9640 Firmware - Qualcomm Mdm9650 Firmware - Qualcomm Msm8917 Firmware - Qualcomm Msm8937 Firmware - Qualcomm Msm8996Au Firmware - Qualcomm Qcn7605 Firmware - Qualcomm Sda845 Firmware - Qualcomm Sdm630 Firmware - Qualcomm Sdm636 Firmware - Qualcomm Sdm660 Firmware - Qualcomm Sdx20 Firmware - Qualcomm Sxr1130 Firmware -	18
Hardware	Qualcomm Qualcomm Apq8053 - Qualcomm Apq8096Au - Qualcomm Apq8098 - Qualcomm Mdm9206 - Qualcomm Mdm9207C - Qualcomm Mdm9607 - Qualcomm Mdm9640 - Qualcomm Mdm9650 - Qualcomm Msm8917 - Qualcomm Msm8937 - Qualcomm Msm8996Au - Qualcomm Qcn7605 - Qualcomm Sda845 - Qualcomm Sdm630 - Qualcomm Sdm636 - Qualcomm Sdm660 - Qualcomm Sdx20 - Qualcomm Sxr1130 -	18

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

References

https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin