CVE-2020-11265 : Information disclosure issue due to lack of validation of pointer arguments pass

Information disclosure issue due to lack of validation of pointer arguments passed to TZ BSP in Snapdragon Wired Infrastructure and Networking

Published 2021-06-09 05:15:08

Updated 2021-06-17 14:43:56

Source Qualcomm, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-11265

Qualcomm » Ipq4019 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ipq4019_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ipq4019 » Version: N/A
Qualcomm » Qca9880 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9880_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9880 » Version: N/A
Qualcomm » Qca9886 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9886_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9886 » Version: N/A
Qualcomm » Wcd9340 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9340 » Version: N/A
Qualcomm » Wsa8810 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8810 » Version: N/A
Qualcomm » Csr8811 Firmware » Version: N/A
cpe:2.3:o:qualcomm:csr8811_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Csr8811 » Version: N/A
Qualcomm » Ipq4018 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ipq4018_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ipq4018 » Version: N/A
Qualcomm » Ipq4028 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ipq4028_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ipq4028 » Version: N/A
Qualcomm » Ipq4029 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ipq4029_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ipq4029 » Version: N/A
Qualcomm » Qca4024 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca4024_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca4024 » Version: N/A
Qualcomm » Qca8075 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca8075_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca8075 » Version: N/A
Qualcomm » Qca9888 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9888_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9888 » Version: N/A
Qualcomm » Qca9889 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9889_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9889 » Version: N/A
Qualcomm » Qca9898 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9898_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9898 » Version: N/A
Qualcomm » Qca9984 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9984_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9984 » Version: N/A
Qualcomm » Qca9992 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9992_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9992 » Version: N/A
Qualcomm » Qca9994 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9994_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9994 » Version: N/A
Qualcomm » Qca7500 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca7500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca7500 » Version: N/A
Qualcomm » Qfe1922 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qfe1922_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qfe1922 » Version: N/A
Qualcomm » Qfe1952 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qfe1952_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qfe1952 » Version: N/A
Qualcomm » Ar7420 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ar7420_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ar7420 » Version: N/A
Qualcomm » Qca7520 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca7520_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca7520 » Version: N/A
Qualcomm » Qca7550 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca7550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca7550 » Version: N/A
Qualcomm » Qcn3018 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcn3018_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcn3018 » Version: N/A
Qualcomm » Ar9580 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ar9580_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ar9580 » Version: N/A
Qualcomm » Qca10901 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca10901_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca10901 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-11265

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-11265

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-11265

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-11265

https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin

January 2021 Security Bulletin | Qualcomm
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-11265

Products affected by CVE-2020-11265

Exploit prediction scoring system (EPSS) score for CVE-2020-11265

CVSS scores for CVE-2020-11265

CWE ids for CVE-2020-11265

References for CVE-2020-11265