CVE-2019-10513

MEDIUM

Qualcomm Snapdragon Firmware - Null Pointer Dereference in TrustZone via Non-Standard SPDM Commands

Title source: llm

Description

Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ8074, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA8081, QCS404, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin

Scores

CVSS v3 5.5

EPSS 0.0011

EPSS Percentile 28.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (49)

qualcomm/apq8009_firmware

qualcomm/apq8017_firmware

qualcomm/apq8053_firmware

qualcomm/apq8096_firmware

qualcomm/apq8096au_firmware

qualcomm/apq8098_firmware

qualcomm/ipq8074_firmware

qualcomm/mdm9150_firmware

qualcomm/mdm9205_firmware

qualcomm/mdm9206_firmware

... and 39 more

Published Dec 18, 2019

Tracked Since Feb 18, 2026