CVE-2020-3652

Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable received. in Snapdragon Compute, Snapdragon Connectivity in MSM8998, QCA6390, SC7180, SC8180X, SDM850

CVSS v3 9.1 CRITICAL
CVSS v2.0 9.4 HIGH

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

9.4^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:C

Exploitability : 10.0 / Impact : 9.2

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:qualcomm:msm8998_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:msm8998:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:qualcomm:sc7180_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:sc7180:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:qualcomm:sc8180x_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:sc8180x:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:qualcomm:sdm850_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:sdm850:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-04-16 11:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-3652

Mitre link : CVE-2020-3652

CVE.ORG link : CVE-2020-3652

JSON object : View

Products Affected

qualcomm

qca6390_firmware
sdm850_firmware
sc7180_firmware
qca6390
msm8998_firmware
sdm850
sc7180
msm8998
sc8180x
sc8180x_firmware

CWE

CWE-125

Out-of-bounds Read

CWE-20

Improper Input Validation

{"id": "CVE-2020-3652", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 9.2, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2020-04-16T11:15:15.730", "references": [{"url": "https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin", "tags": ["Vendor Advisory"], "source": "product-security@qualcomm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable received. in Snapdragon Compute, Snapdragon Connectivity in MSM8998, QCA6390, SC7180, SC8180X, SDM850"}, {"lang": "es", "value": "Un posible problema de lectura excesiva del b\u00fafer en la funci\u00f3n del controlador wlan de Windows x86 mientras procesa una trama beacon o de petici\u00f3n debido a una falta de comprobaci\u00f3n de la longitud de una variable recibida en los productos in Snapdragon Compute, Snapdragon Connectivity en versiones MSM8998, QCA6390, SC7180, SC8180X, SDM850."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:msm8998_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E9154AF-E52E-4E84-9322-2CA7EBD3E6FE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:msm8998:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4796F9BD-61B3-45ED-B5E3-B061887285E2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96FBD6DF-F174-4690-AA3D-1E8974E3627F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A3BF86E1-3FAC-4A42-8C01-5944C6C30AE5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sc7180_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "792A18B7-E775-4AF4-A8C4-D434400317B0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sc7180:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B5170B38-0976-49BB-A916-5BE44C567218"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sc8180x_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30A45C1A-C921-42B5-9237-367245023B45"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sc8180x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "56C9D979-F214-4CD4-8CF9-43BC804BB179"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:sdm850_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3ADE826-C55D-4731-80B9-164FEA290FAC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:sdm850:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8ED4F8FE-32DB-4696-A3AD-A9D7CB7E513A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "product-security@qualcomm.com"}