High severity · published Jul 25, 2019
CVE-2019-2301
Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9980, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX24
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipq4019 Firmware · Qualcomm
All versions, or not specified · source: NVD
IF
Ipq8064 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8909w Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca9980 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
Q2
Qualcomm 215 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 425 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 429 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 439 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 450 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 625 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2301
Patch
https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
More from Ipq4019 Firmware
7.8
CVE-2023-33063
Use After Free in DSP Services
9.8
CVE-2024-21473
Improper Input Validation in WIN SON
9.8
CVE-2023-33083
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
9.8
CVE-2023-33082
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
9.8
CVE-2022-33279
Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length