CVE-2019-10618 Null dereference in Snapdragon Connectivity
A missing address validation in the Snapdragon Connectivity driver allows attackers to trigger invalid memory access, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10618?
CVE-2019-10618 is a medium-severity vulnerability in Qualcomm Qca6390 Firmware, published on 12 Dec 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Driver may access an invalid address while processing IO control due to lack of check of address validation in Snapdragon Connectivity in QCA6390
Weakness: CWE-119
Which versions are affected by CVE-2019-10618?
It affects 1 product.
Products include Qualcomm Qca6390 Firmware.
How do I fix CVE-2019-10618?
No fix has been published for CVE-2019-10618 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10618 being exploited?
There is no known exploitation of CVE-2019-10618 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qca6390 Firmware
- CVE-2021-30336 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Wearables
- CVE-2020-11156 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- CVE-2023-21667 Buffer Over-read in Bluetooth HOST
- CVE-2023-21647 Improper Input Validation in Bluetooth HOST
- CVE-2021-30314 Information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Sources
Also known as GHSA-rxm3-cc74-v7p3.