CVE-2020-3653 Memory corruption in Snapdragon Compute, Snapdragon Connectivity
A buffer over-read in the Windows WLAN driver allows attackers to cause denial of service or disclose sensitive information via crafted user-space input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3653?
CVE-2020-3653 is a critical memory corruption vulnerability in Qualcomm Msm8998 Firmware, published on 16 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon Compute, Snapdragon Connectivity in MSM8998, QCA6390, SC7180, SC8180X, SDM850
Which versions are affected by CVE-2020-3653?
It affects 5 products.
Products include Qualcomm Msm8998 Firmware, Qualcomm Qca6390 Firmware, Qualcomm Sc7180 Firmware, Qualcomm Sc8180x Firmware, Qualcomm Sdm850 Firmware.
How do I fix CVE-2020-3653?
No fix has been published for CVE-2020-3653 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-3653 being exploited?
There is no known exploitation of CVE-2020-3653 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Msm8998 Firmware
Sources
Also known as GHSA-x9pc-2xp2-2gh9.