CVE-2020-3691 Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Critical 9.8 Published 21 Jan 2021 Updated 4 Aug 2024

An integer underflow in Qualcomm Snapdragon audio processing allows out-of-bounds memory access, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3691?

CVE-2020-3691 is a critical vulnerability in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking, published on 21 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Weakness: CWE-191

Which versions are affected by CVE-2020-3691?

It affects 506 products.

Products include Qualcomm Apq8009, Qualcomm Apq8009w, Qualcomm Apq8017, Qualcomm Apq8030, Qualcomm Apq8037, Qualcomm Apq8052 and 500 more.

How do I fix CVE-2020-3691?

No fix has been published for CVE-2020-3691 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3691 being exploited?

There is no known exploitation of CVE-2020-3691 in the wild and no public exploit code.

Sources

Also known as GHSA-5gm8-7pfq-h7gr.