CVE-2020-11172 Memory corruption in Snapdragon Wired Infrastructure and Networking
A stack overflow in Snapdragon networking firmware allows attackers to execute arbitrary code or cause denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11172?
CVE-2020-11172 is a critical memory corruption vulnerability in Qualcomm Ipq4019 Firmware, published on 2 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
u'fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow' in Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA9531, QCA9980
Weakness: CWE-120
Which versions are affected by CVE-2020-11172?
It affects 6 products.
Products include Qualcomm Ipq4019 Firmware, Qualcomm Ipq6018 Firmware, Qualcomm Ipq8064 Firmware, Qualcomm Ipq8074 Firmware, Qualcomm Qca9531 Firmware, Qualcomm Qca9980 Firmware.
How do I fix CVE-2020-11172?
No fix has been published for CVE-2020-11172 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-11172 being exploited?
There is no known exploitation of CVE-2020-11172 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Ipq4019 Firmware
- CVE-2020-11117 Command injection in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking
- CVE-2014-10045 Memory corruption in Snapdragon Mobile, Snapdragon Wear
- CVE-2014-9988 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
- CVE-2014-9998 In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ40
- CVE-2015-9120 Denial of service in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Sources
Also known as GHSA-wm9r-343v-whjh.