CVE-2019-10510 Null dereference in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

High 8.2 Published 30 Sep 2019 Updated 4 Aug 2024

Remote attackers can cause Bluetooth service crashes and toggling via invalid vendor commands in Qualcomm Snapdragon firmware.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-10510?

CVE-2019-10510 is a high-severity vulnerability in Qualcomm Qcs405 Firmware, published on 30 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660

Weakness: CWE-476

Which versions are affected by CVE-2019-10510?

It affects 12 products.

Products include Qualcomm Qcs405 Firmware, Qualcomm Qcs605 Firmware, Qualcomm Sd 636 Firmware, Qualcomm Sd 675 Firmware, Qualcomm Sd 730 Firmware, Qualcomm Sd 820a Firmware and 6 more.

How do I fix CVE-2019-10510?

No fix has been published for CVE-2019-10510 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-10510 being exploited?

There is no known exploitation of CVE-2019-10510 in the wild and no public exploit code.

All Qualcomm Qcs405 Firmware vulnerabilities

Sources

Also known as GHSA-mfjm-6mcc-27fw.