Use of Out-of-range Pointer Offset in Qualcomm products - CVE-2020-11257

Vulnerability identifier: #VU51657

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11257

CWE-ID: CWE-823

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system

The vulnerability exists due to a boundary error in WIN TZ FW, when processing a pointer to buffer in trustzone BSP. A local user can run a specially crafted program to trigger an out-of-bound pointer offset and execute arbitrary code on the system with elevated privileges.

QCA9880
WSA8810
WCD9340
QFE1952
QFE1922
QCN3018
QCA9994
QCA9992
QCA9984
QCA9898
QCA9889
QCA9888
QCA9886
AR7420
QCA8075
QCA7550
QCA7520
QCA7500
QCA4024
QCA10901
IPQ4029
IPQ4028
IPQ4018
CSR8811
AR9580
IPQ4019

Install updates from vendor's website.

• https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin

• Multiple vulnerabilities in Qualcomm chipsets