CVE-2019-2290

HIGH

Qualcomm Snapdragon Firmware - Use-After-Free in Camera Driver Session Handling

Title source: llm

Description

Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDM660, SDX20, SDX24, Snapdragon_High_Med_2016

References (1)

Core 1

Core References

Patch, Third Party Advisory x_refsource_confirm

https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin

Scores

CVSS v3 7.8

EPSS 0.0004

EPSS Percentile 13.1%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-416

Status published

Products (28)

qualcomm/mdm9206_firmware

qualcomm/mdm9607_firmware

qualcomm/mdm9640_firmware

qualcomm/mdm9650_firmware

qualcomm/msm8909w_firmware

qualcomm/msm8996au_firmware

qualcomm/qcs605_firmware

qualcomm/sd_425_firmware

qualcomm/sd_427_firmware

qualcomm/sd_430_firmware

... and 18 more

Published Jul 25, 2019

Tracked Since Feb 18, 2026