Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2019-2288—Out of bound write in TZ while copying the secure dump structure on HLOS provided buffer as a part of memory dump in Snapdragon Auto, SnapdrEPSS 0.2%CVE-2019-2246—Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto,EPSS 0.2%CVE-2019-14044—Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon ConsuEPSS 0.2%CVE-2020-11246HIGHA double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snapdragon Compute, SnapdEPSS 0.2%CVE-2020-11242HIGHUser could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contentEPSS 0.2%CVE-2019-10548—While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same time in SEPSS 0.2%CVE-2019-2339—Out of bound access due to lack of check of whiltelist array size while reading the image elf segments. in Snapdragon Auto, Snapdragon CompuEPSS 0.2%CVE-2019-14105—Kernel was reading the CSL defined reserved field as uint16 instead of uint32 which could lead to memory overflow in Snapdragon Industrial IEPSS 0.2%CVE-2019-14000—Lack of check that the RX FIFO write index that is read from shared RAM is less than the FIFO size results into memory corruption and potentEPSS 0.2%CVE-2019-14068—Out of bound access in msm routing due to lack of check of size before accessing in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumerEPSS 0.2%CVE-2018-11838—Possible double free issue in WLAN due to lack of checking memory free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumeEPSS 0.2%CVE-2019-14054—Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in EPSS 0.2%CVE-2019-2321—Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, SnapdrEPSS 0.2%CVE-2020-11205—u'Possible integer overflow to heap overflow while processing command due to lack of check of packet length received' in Snapdragon Auto, SnEPSS 0.2%CVE-2017-15825—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a gpt update, aEPSS 0.2%CVE-2019-2315—While invoking the API to copy from fd or local buffer to the secure buffer, Parameters being populated are from non secure environment. in EPSS 0.2%CVE-2019-14029—Use-after-free in graphics module due to destroying already queued syncobj in error case in Snapdragon Auto, Snapdragon Compute, Snapdragon EPSS 0.2%CVE-2019-10582—Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdragon Consumer IOT, SnEPSS 0.2%CVE-2018-11902—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check EPSS 0.2%CVE-2018-3595—Anti-rollback can be bypassed in replay scenario during app loading due to improper error handling of RPMB writes in snapdragon automobile, EPSS 0.2%