Vulnerability identifier: #VU51890

Vulnerability risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11242

CWE-ID: CWE-823

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
PM660
Mobile applications / Mobile firmware & hardware
PM660A
Mobile applications / Mobile firmware & hardware
PM660L
Mobile applications / Mobile firmware & hardware
PM855A
Mobile applications / Mobile firmware & hardware
PMM855AU
Mobile applications / Mobile firmware & hardware
QAT3514
Mobile applications / Mobile firmware & hardware
QAT3522
Mobile applications / Mobile firmware & hardware
QAT3550
Mobile applications / Mobile firmware & hardware
QCA6564A
Mobile applications / Mobile firmware & hardware
QCA6564AU
Mobile applications / Mobile firmware & hardware
QCA6574A
Mobile applications / Mobile firmware & hardware
QCA6595
Mobile applications / Mobile firmware & hardware
QCA6595AU
Mobile applications / Mobile firmware & hardware
QET4100
Mobile applications / Mobile firmware & hardware
QET4101
Mobile applications / Mobile firmware & hardware
QET4200AQ
Mobile applications / Mobile firmware & hardware
QLN1021AQ
Mobile applications / Mobile firmware & hardware
QLN1031
Mobile applications / Mobile firmware & hardware
QLN1036AQ
Mobile applications / Mobile firmware & hardware
QPA4340
Mobile applications / Mobile firmware & hardware
QPA4360
Mobile applications / Mobile firmware & hardware
QPA5460
Mobile applications / Mobile firmware & hardware
QTC800H
Mobile applications / Mobile firmware & hardware
QTC800S
Mobile applications / Mobile firmware & hardware
RSW8577
Mobile applications / Mobile firmware & hardware
SD455
Mobile applications / Mobile firmware & hardware
SD660
Mobile applications / Mobile firmware & hardware
SDR660
Mobile applications / Mobile firmware & hardware
SMB1351
Mobile applications / Mobile firmware & hardware
WCD9335
Mobile applications / Mobile firmware & hardware
WCD9340
Mobile applications / Mobile firmware & hardware
WCD9341
Mobile applications / Mobile firmware & hardware
WCN3950
Mobile applications / Mobile firmware & hardware
WCN3980
Mobile applications / Mobile firmware & hardware
WCN3990
Mobile applications / Mobile firmware & hardware
QCA6574AU
Hardware solutions / Firmware
SD636
Hardware solutions / Firmware
SDM630
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect argument into address range validation api used in SDI to capture requested contents. A local user can gain access to secure memory and elevate privileges on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

PM660: All versions

PM660A: All versions

PM660L: All versions

PM855A: All versions

PMM855AU: All versions

QAT3514: All versions

QAT3522: All versions

QAT3550: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595: All versions

QCA6595AU: All versions

QET4100: All versions

QET4101: All versions

QET4200AQ: All versions

QLN1021AQ: All versions

QLN1031: All versions

QLN1036AQ: All versions

QPA4340: All versions

QPA4360: All versions

QPA5460: All versions

QTC800H: All versions

QTC800S: All versions

RSW8577: All versions

SD455: All versions

SD636: All versions

SD660: All versions

SDM630: All versions

SDR660: All versions

SMB1351: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCN3950: All versions

WCN3980: All versions

WCN3990: All versions

---

External links
http://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.