Integer overflow in Qualcomm products - CVE-2020-11306

Vulnerability identifier: #VU53859

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11306

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to integer overflow in the QTEE subsystem within RPMB counter. A local application can trigger an integer overflow and escalate privileges on the system.

SM4125
WCD9375
WCD9371
WCD9370
WCD9360
WCD9341
WCD9340
SM7325P
SM7250P
SM6250P
SM6250
WCD9380
SDXR25G
SDX55M
SDM830
SD8885G
SD870
SD8655G
WCN6750
WSA8835
WSA8830
WSA8815
WSA8810
WHS9410
WCN6856
WCN6855
WCN6851
WCN6850
WCN3999
WCN3998
WCN3991
WCN3990
WCN3988
WCN3980
WCN3950
WCN3910
WCD9385
QCS610
QCS4290
QCS410
QCS2290
QCM4290
QCM2290
QCA9984
QCA6595
QSM8250
QCA6436
QCA6431
QCA6430
QCA6426
QCA6421
QCA6420
QCA6391
QCA6390
AR8035
SD678
SD7c
SD778G
SD768G
SD765G
SD765
SD750G
SD720G
SD6905G
AQT1000
SD662
SD480
SD460
SD8CX
SD8C
SA8195P
QSM8350
SDX55
SDX24
SD888
SD855
QCA6574AU
QCS405
SD730
SD675
SA6155P
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 8.1 2021-06-05, 9.0 2021-06-05, 10 2021-06-05, 11 2021-06-05

• https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android