CVE-2020-11257 Memory corruption in Snapdragon Wired Infrastructure and Networking
Memory corruption in TrustZone BSP allows attackers to execute arbitrary code or escalate privileges on Snapdragon Wired Infrastructure devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11257?
CVE-2020-11257 is a high-severity memory corruption vulnerability in Qualcomm Csr8811 Firmware, published on 9 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking
Weakness: CWE-119
Which versions are affected by CVE-2020-11257?
It affects 26 products.
Products include Qualcomm Ar7420 Firmware, Qualcomm Ar9580 Firmware, Qualcomm Csr8811 Firmware, Qualcomm Ipq4018 Firmware, Qualcomm Ipq4019 Firmware, Qualcomm Ipq4028 Firmware and 20 more.
How do I fix CVE-2020-11257?
No fix has been published for CVE-2020-11257 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-11257 being exploited?
There is no known exploitation of CVE-2020-11257 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Csr8811 Firmware
- CVE-2020-11256 Memory corruption in Snapdragon Wired Infrastructure and Networking
- CVE-2020-11258 Memory corruption in Snapdragon Wired Infrastructure and Networking
- CVE-2020-11259 Memory corruption in Snapdragon Wired Infrastructure and Networking
- CVE-2021-1887 Denial of service in Snapdragon Wired Infrastructure and Networking
- CVE-2020-11266 Information disclosure in Snapdragon Wired Infrastructure and Networking
Sources
Also known as GHSA-qw8g-gg9h-f9g7.