Improper Validation of Array Index in Qualcomm products - CVE-2020-11176

Vulnerability identifier: #VU53856

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11176

CWE-ID: CWE-129

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error when processing server certificate from IPSec server. A remote attacker can supply a certificate with a specially crafted subject alternative name API, trigger heap-based buffer overflow and execute arbitrary code on the system.

SDX50M
WCD9370
WCD9360
WCD9341
WCD9340
WCD9335
WCD9326
SM7250P
SM6250P
SM6250
SDXR25G
SDX55M
WCD9371
SD8885G
SD870
SD8655G
SD768G
SD765G
SD765
SD750G
WCN3991
WSA8835
WSA8830
WSA8815
WSA8810
WHS9410
WCN6856
WCN6855
WCN6851
WCN6850
WCN6750
WCN3998
SD720G
WCN3990
WCN3988
WCN3980
WCN3950
WCN3910
WCN3680B
WCN3660B
WCN3615
WCD9385
WCD9380
WCD9375
QCA6390
QCA6595AU
QCA6584AU
QCA6574A
QCA6564AU
QCA6436
QCA6431
QCA6430
QCA6426
QCA6421
QCA6420
QCA6391
QCA6696
MSM8976SG
MSM8976
CSRB31024
AR8035
AQT1000
SA8155
SD6905G
SD678
SD480
SD8CX
SD8C
SC8180X+SDX55
SA8155P
SA515M
SA415M
QCS6125
QCS610
QCS4290
QCS410
QCM6125
QCM4290
QCA8337
SDX55
SDX24
SD855
SD845
SD730
QCA6574AU
QCA6174A
MSM8953
MSM8940
MSM8920
MSM8917
APQ8053
SD670
SD665
SD450
SD675
APQ8017
QCA9379
QCA9377
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 8.1 2021-06-05, 9.0 2021-06-05, 10 2021-06-05, 11 2021-06-05

• https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android