Vulnerability Name:

CVE-2019-2319 (CCN-173087)

Assigned:2018-12-10
Published:2019-11-04
Updated:2020-08-24
Summary:HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-2319

Source: XF
Type: UNKNOWN
qualcomm-cve20192319-unspecified(173087)

Source: CCN
Type: Qualcomm Web site
November 2019 Security Bulletin

Source: CONFIRM
Type: Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin

Vulnerable Configuration:Configuration 1:
  • cpe:/o:qualcomm:mdm9205_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:mdm9205:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:qualcomm:qcs404_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:qcs404:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:qcs605:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:qualcomm:sda845_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sda845:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:qualcomm:sdm670_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm670:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:qualcomm:sdm710_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm710:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm845:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:qualcomm:sdm850_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sdm850:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:qualcomm:sm6150_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sm6150:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:qualcomm:sm7150_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sm7150:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sm8150:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:qualcomm:sxr1130_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sxr1130:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:sxr2130:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/h:qualcomm:snapdragon_mobile:-:*:*:*:*:*:*:*
  • OR cpe:/h:qualcomm:snapdragon_auto:-:*:*:*:*:*:*:*
  • OR cpe:/h:qualcomm:snapdragon_compute:-:*:*:*:*:*:*:*
  • OR cpe:/h:qualcomm:snapdragon_connectivity:-:*:*:*:*:*:*:*
  • OR cpe:/h:qualcomm:snapdragon_consumer_internet_of_things:-:*:*:*:*:*:*:*
  • OR cpe:/h:qualcomm:snapdragon_industrial_internet_of_things:-:*:*:*:*:*:*:*
  • OR cpe:/o:qualcomm:snapdragon_wired_infrastructure_&_networking:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    qualcomm mdm9205 firmware -
    qualcomm mdm9205 -
    qualcomm qcs404 firmware -
    qualcomm qcs404 -
    qualcomm qcs605 firmware -
    qualcomm qcs605 -
    qualcomm sda845 firmware -
    qualcomm sda845 -
    qualcomm sdm670 firmware -
    qualcomm sdm670 -
    qualcomm sdm710 firmware -
    qualcomm sdm710 -
    qualcomm sdm845 firmware -
    qualcomm sdm845 -
    qualcomm sdm850 firmware -
    qualcomm sdm850 -
    qualcomm sm6150 firmware -
    qualcomm sm6150 -
    qualcomm sm7150 firmware -
    qualcomm sm7150 -
    qualcomm sm8150 firmware -
    qualcomm sm8150 -
    qualcomm sxr1130 firmware -
    qualcomm sxr1130 -
    qualcomm sxr2130 firmware -
    qualcomm sxr2130 -
    qualcomm snapdragon mobile -
    qualcomm snapdragon auto -
    qualcomm snapdragon compute -
    qualcomm snapdragon connectivity -
    qualcomm snapdragon consumer internet of things -
    qualcomm snapdragon industrial internet of things -
    qualcomm snapdragon wired infrastructure & networking -