7.2
CVSSv2

CVE-2019-10499

Published: 30/09/2019 Updated: 02/10/2019
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 642
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

Improper validation of read and write index of tx and rx fifo`s before using for data copy from fifo can lead to out-of-bound access. in Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, QCS405, SD 665, SD 675, SD 730, SD 855

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

qualcomm ipq4019_firmware -

qualcomm ipq8064_firmware -

qualcomm ipq8074_firmware -

qualcomm qcs405_firmware -

qualcomm sd_665_firmware -

qualcomm sd_675_firmware -

qualcomm sd_730_firmware -

qualcomm sd_855_firmware -

Github Repositories

Patchlocator Open source patch presence test system Given a patch commit in upstream repository, check if the patch is applied in downstream kernels There are three kinds of kernels: Repository Patchlocator can make use of information of the patches (introduction message, commit date, changed lines, etc) to locate the corresponding commit in target repository If the targ

An Investigation of the Android Kernel Patch Ecosystem Usenix security 21

Patchlocator Open source patch presence test system Given a patch commit in upstream repository, check if the patch is applied in downstream kernels There are three kinds of kernels: Repository Patchlocator can make use of information of the patches (introduction message, commit date, changed lines, etc) to locate the corresponding commit in target repository If the targ

Recent Articles

It's 2019 – and you can completely pwn millions of Qualcomm-powered Androids over the air
The Register • Shaun Nichols in San Francisco • 06 Aug 2019

Grab security patches now from chip designer, Google Exposed: Lazy Android mobe makers couldn't care less about security

Black Hat It is possible to thoroughly hijack a nearby vulnerable Qualcomm-based Android phone, tablet, or similar gadget, via Wi-Fi, we learned on Monday. This likely affects millions of Android devices. Specifically, the following two security holes, dubbed Qualpwn and found by Tencent's Blade Team, can be leveraged one after the other to potentially take over a handheld: Thus, it is possible for a miscreant to join a nearby wireless network, seek out a vulnerable Qualcomm-powered Android devi...

It's 2019 – and you can completely pwn millions of Qualcomm-powered Androids over the air
The Register • Shaun Nichols in San Francisco • 06 Aug 2019

Grab security patches now from chip designer, Google Exposed: Lazy Android mobe makers couldn't care less about security

Black Hat It is possible to thoroughly hijack a nearby vulnerable Qualcomm-based Android phone, tablet, or similar gadget, via Wi-Fi, we learned on Monday. This likely affects millions of Android devices. Specifically, the following two security holes, dubbed Qualpwn and found by Tencent's Blade Team, can be leveraged one after the other to potentially take over a handheld: Thus, it is possible for a miscreant to join a nearby wireless network, seek out a vulnerable Qualcomm-powered Android devi...