CVE-2020-11173 Race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
A race condition in the fastRPC driver allows attackers to potentially execute code or escalate privileges on affected Qualcomm Snapdragon devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11173?
CVE-2020-11173 is a high-severity vulnerability in Qualcomm Apq8053 Firmware, published on 2 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8053, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MSM8953, Nicobar, QCA6390, QCS404, QCS405, QCS610, Rennell, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM632, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Which versions are affected by CVE-2020-11173?
It affects 33 products.
Products include Qualcomm Agatti Firmware, Qualcomm Apq8053 Firmware, Qualcomm Bitra Firmware, Qualcomm Ipq4019 Firmware, Qualcomm Ipq5018 Firmware, Qualcomm Ipq6018 Firmware and 27 more.
How do I fix CVE-2020-11173?
Apply the vendor's patch.
Is CVE-2020-11173 being exploited?
There is no known exploitation of CVE-2020-11173 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8053 Firmware
- CVE-2020-3654 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- CVE-2020-3673 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- CVE-2020-3692 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- CVE-2020-3670 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- CVE-2020-11125 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Sources
Also known as 2646001, A-160605709, ASB-A-160605709, GHSA-g995-488q-qmgf.