Vulnerabilities > CVE-2019-14024 - Use After Free vulnerability in Qualcomm products

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

qualcomm

CWE-416

NVD

Published: 2020-01-21

Updated: 2020-01-24

Summary

Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130

Vulnerable Configurations

Part	Description	Count
OS	Qualcomm Qualcomm Msm8917 Firmware - Qualcomm Msm8953 Firmware - Qualcomm Nicobar Firmware - Qualcomm Qm215 Firmware - Qualcomm Rennell Firmware - Qualcomm Sdm429 Firmware - Qualcomm Sdm439 Firmware - Qualcomm Sdm450 Firmware - Qualcomm Sdm632 Firmware - Qualcomm Sdm670 Firmware - Qualcomm Sdm710 Firmware - Qualcomm Sdm845 Firmware - Qualcomm Sm6150 Firmware - Qualcomm Sm7150 Firmware - Qualcomm Sm8150 Firmware - Qualcomm Sm8250 Firmware - Qualcomm Sxr2130 Firmware -	17
Hardware	Qualcomm Qualcomm Msm8917 - Qualcomm Msm8953 - Qualcomm Nicobar - Qualcomm Qm215 - Qualcomm Rennell - Qualcomm Sdm429 - Qualcomm Sdm439 - Qualcomm Sdm450 - Qualcomm Sdm632 - Qualcomm Sdm670 - Qualcomm Sdm710 - Qualcomm Sdm845 - Qualcomm Sm6150 - Qualcomm Sm7150 - Qualcomm Sm8150 - Qualcomm Sm8250 - Qualcomm Sxr2130 -	17

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

References

https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin