CVE-2020-11240

HIGH

Snapdragon Auto - Memory Corruption

Title source: llm

Description

Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for the copy of the user argument in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

References (1)

[Patch, Vendor Advisory] https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin

Scores

CVSS v3 7.8

EPSS 0.0004

EPSS Percentile 11.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-131

Status published

Affected Products (50)

qualcomm/apq8009w_firmware

qualcomm/apq8017_firmware

qualcomm/apq8053_firmware

qualcomm/aqt1000_firmware

qualcomm/ar8031_firmware

qualcomm/ar8035_firmware

qualcomm/csra6620_firmware

qualcomm/csra6640_firmware

qualcomm/csrb31024_firmware

qualcomm/msm8909w_firmware

qualcomm/msm8917_firmware

qualcomm/msm8953_firmware

qualcomm/pm215_firmware

qualcomm/pm3003a_firmware

qualcomm/pm4125_firmware

... and 35 more

Timeline

Published Jun 09, 2021

Tracked Since Feb 18, 2026