CVE-2020-3615 Denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
A flaw in Qualcomm Snapdragon firmware allows rogue peers to drop valid deauth frames, causing denial of service when RMF is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3615?
CVE-2020-3615 is a critical denial of service vulnerability in Qualcomm Apq8009 Firmware, published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames due to improper enum values used to check the frame subtype in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8009, APQ8053, APQ8096AU, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SC8180X, SDM630, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM8150, SXR1130
Weakness: CWE-617
Which versions are affected by CVE-2020-3615?
It affects 25 products.
Products include Qualcomm Apq8009 Firmware, Qualcomm Apq8053 Firmware, Qualcomm Apq8096au Firmware, Qualcomm Mdm9150 Firmware, Qualcomm Mdm9206 Firmware, Qualcomm Mdm9207c Firmware and 19 more.
How do I fix CVE-2020-3615?
No fix has been published for CVE-2020-3615 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-3615 being exploited?
There is no known exploitation of CVE-2020-3615 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8009 Firmware
- CVE-2021-1905 Qualcomm Multiple Chipsets Use-After-Free
- CVE-2020-11261 Qualcomm Multiple Chipsets Improper Input Validation
- CVE-2021-1906 Qualcomm Multiple Chipsets Detection of Error Condition Without Action
- CVE-2022-40510 Buffer copy without checking size of input in Audio.
- CVE-2022-22088 Integer Overflow to Buffer Overflow in Bluetooth HOST
Sources
Also known as GHSA-8xmf-9w6j-h6fw.