Buffer over-read in Qualcomm products - CVE-2020-11266

Vulnerability identifier: #VU71897

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11266

CWE-ID: CWE-126

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to improper input validation in Trustzone. A local application can read and manipulate data.

QCA9880
WSA8810
WCD9340
QFE1952
QFE1922
QCN3018
QCA9994
QCA9992
QCA9984
QCA9898
QCA9889
QCA9888
QCA9886
AR7420
QCA8075
QCA7550
QCA7520
QCA7500
QCA4024
QCA10901
IPQ4029
IPQ4028
IPQ4018
CSR8811
AR9580
IPQ4019

Install security update from vendor's website.

• https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin

• Multiple vulnerabilities in Qualcomm chipsets