Vulnerability Name:

CVE-2019-10542 (CCN-171067)

Assigned:2019-11-04
Published:2019-11-04
Updated:2019-11-08
Summary:Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-125
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Google Web site
Android

Source: MITRE
Type: CNA
CVE-2019-10542

Source: XF
Type: UNKNOWN
android-cve201910542-code-exec(171067)

Source: CONFIRM
Type: Patch, Vendor Advisory
https://source.android.com/security/bulletin/

Source: CCN
Type: Android Open Source Project
Pixel Update Bulletin—September 2019

Vulnerable Configuration:Configuration 1:
  • cpe:/o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9150:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9206:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9607:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:qualcomm:mdm9615_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9615:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9640:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9650:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:msm8996au:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:qca6174a:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:qca6574au:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:qca9377:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:qualcomm:qca9379_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:qca9379:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_210:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_212:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_205:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_425:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:qualcomm:sd_427_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_427:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_430:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:qualcomm:sd_435_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_435:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_450:-:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:qualcomm:sd_600_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_600:-:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_625:-:*:*:*:*:*:*:*

    • Configuration 22:
  • cpe:/o:qualcomm:sd_712_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_712:-:*:*:*:*:*:*:*

    • Configuration 23:
  • cpe:/o:qualcomm:sd_710_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_710:-:*:*:*:*:*:*:*

    • Configuration 24:
  • cpe:/o:qualcomm:sd_670_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_670:-:*:*:*:*:*:*:*

    • Configuration 25:
  • cpe:/o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_820:-:*:*:*:*:*:*:*

    • Configuration 26:
  • cpe:/o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_820a:-:*:*:*:*:*:*:*

    • Configuration 27:
  • cpe:/o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_845:-:*:*:*:*:*:*:*

    • Configuration 28:
  • cpe:/o:qualcomm:sd_850_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sd_850:-:*:*:*:*:*:*:*

    • Configuration 29:
  • cpe:/o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdx20:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:google:android:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    qualcomm mdm9150 firmware -
    qualcomm mdm9150 -
    qualcomm mdm9206 firmware -
    qualcomm mdm9206 -
    qualcomm mdm9607 firmware -
    qualcomm mdm9607 -
    qualcomm mdm9615 firmware -
    qualcomm mdm9615 -
    qualcomm mdm9640 firmware -
    qualcomm mdm9640 -
    qualcomm mdm9650 firmware -
    qualcomm mdm9650 -
    qualcomm msm8996au firmware -
    qualcomm msm8996au -
    qualcomm qca6174a firmware -
    qualcomm qca6174a -
    qualcomm qca6574au firmware -
    qualcomm qca6574au -
    qualcomm qca9377 firmware -
    qualcomm qca9377 -
    qualcomm qca9379 firmware -
    qualcomm qca9379 -
    qualcomm sd 210 firmware -
    qualcomm sd 210 -
    qualcomm sd 212 firmware -
    qualcomm sd 212 -
    qualcomm sd 205 firmware -
    qualcomm sd 205 -
    qualcomm sd 425 firmware -
    qualcomm sd 425 -
    qualcomm sd 427 firmware -
    qualcomm sd 427 -
    qualcomm sd 430 firmware -
    qualcomm sd 430 -
    qualcomm sd 435 firmware -
    qualcomm sd 435 -
    qualcomm sd 450 firmware -
    qualcomm sd 450 -
    qualcomm sd 600 firmware -
    qualcomm sd 600 -
    qualcomm sd 625 firmware -
    qualcomm sd 625 -
    qualcomm sd 712 firmware -
    qualcomm sd 712 -
    qualcomm sd 710 firmware -
    qualcomm sd 710 -
    qualcomm sd 670 firmware -
    qualcomm sd 670 -
    qualcomm sd 820 firmware -
    qualcomm sd 820 -
    qualcomm sd 820a firmware -
    qualcomm sd 820a -
    qualcomm sd 845 firmware -
    qualcomm sd 845 -
    qualcomm sd 850 firmware -
    qualcomm sd 850 -
    qualcomm sdx20 firmware -
    qualcomm sdx20 -
    google android *