Junglewise Threat Intelligence

CVE-2020-11261: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

CVE-2020-11261 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2021-12-01

Technologies: Qualcomm Snapdragon Connectivity, Qualcomm Snapdragon Compute, Qualcomm Snapdragon Mobile, Qualcomm Snapdragon Consumer IOT, Qualcomm Snapdragon Wearables, Qualcomm Snapdragon Industrial IOT, Qualcomm Snapdragon Auto. Vendors: Qualcomm.

Executive brief

A memory corruption vulnerability exists in multiple Qualcomm Snapdragon chipsets due to improper input validation when a user application requests a very large memory allocation. This flaw allows for potential out-of-bounds writes and has been observed being exploited in the wild.

Affected products

  • Qualcomm Snapdragon Auto
  • Qualcomm Snapdragon Compute
  • Qualcomm Snapdragon Connectivity
  • Qualcomm Snapdragon Consumer IOT
  • Qualcomm Snapdragon Industrial IOT
  • Qualcomm Snapdragon Mobile
  • Qualcomm Snapdragon Voice & Music
  • Qualcomm Snapdragon Wearables
  • Qualcomm APQ8009 Firmware
  • Qualcomm APQ8009W Firmware

Timeline

  • 2021-01-01: patched: Qualcomm January 2021 Bulletin
  • 2021-12-01: disclosed
  • 2021-12-01: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2021-12-01: exploited: Reported as exploited in the wild at time of publication.

Related threats