CVE-2019-2239 Denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Medium 5.5 Published 25 Jul 2019 Updated 4 Aug 2024

Missing sanity checks in layout allow attackers to cause SUI corruption or denial of service on various Qualcomm Snapdragon chipsets.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-2239?

CVE-2019-2239 is a medium-severity denial of service vulnerability in Qualcomm Mdm9150 Firmware, published on 25 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Sanity checks are missing in layout which can lead to SUI Corruption or can lead to Denial of Service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9150, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8996AU, QCS404, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, Snapdragon_High_Med_2016, SXR1130

Weakness: CWE-129

Which versions are affected by CVE-2019-2239?

It affects 50 products.

Products include Qualcomm Mdm9150 Firmware, Qualcomm Mdm9206 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9635m Firmware, Qualcomm Mdm9640 Firmware, Qualcomm Mdm9650 Firmware and 44 more.

How do I fix CVE-2019-2239?

No fix has been published for CVE-2019-2239 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-2239 being exploited?

There is no known exploitation of CVE-2019-2239 in the wild and no public exploit code.

All Qualcomm Mdm9150 Firmware vulnerabilities

Sources

Also known as GHSA-xr4p-36qq-6m8m.