Input validation error in Qualcomm products - CVE-2020-11268

Vulnerability identifier: #VU52805

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11268

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in LTE implementation. Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to a remote denial of service.

QFE2330
QFE3345
QFE3340
QFE3335
QFE3320
QFE3100
QFE2720
QFE2550
QFE2520
QFE2340
SMB1360
QFE2320
QFE2310
QFE2101
QFE1550
QFE1520
QFE1101
QFE1100
QFE1045
QFE1040
QFE1035
WFR1620
WTR4905
WTR4605
WTR3925
WTR2955
WTR2605
WTR1625L
WTR1625
WTR1605L
WTR1605
WGR7640
QCA6584
WCN3680B
WCN3680
WCN3660B
WCN3660A
WCN3660
WCN3620
WCN3610
WCD9330
WCD9306
MDM9310
MSM8216
MSM8209
MSM8208
MSM8108
MDM9645
MDM9635M
MDM9615M
MDM9615
MDM9609
MSM8274
MDM9235M
MDM9215
MDM8615M
MDM8215M
MDM8215
AR6003
APQ8094
APQ8084
APQ8074
APQ8016
PM8841
QCA6174
QCA1990
PMI8994
PMD9645
PMD9635
PM8994
PM8941
PM8916
PM8909
PM8018
MSM8994
MSM8974P
MSM8974
MSM8939
MSM8929
MSM8916
MSM8674
MSM8608
SD210
MDM9640
QCA6174A
APQ8009

Install updates from vendor's website.

• https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin

• Multiple vulnerabilities in Qualcomm chipsets