CVE-2019-14119: qualcomm ipq6018_firmware
Vulnerability summary
CVE-2019-14119 is a high (CVSS 7.0) vulnerability in qualcomm ipq6018_firmware. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.
Timeline
- 08-09-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition and lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ6018, Kamorta, MDM9205, MDM9607, Nicobar, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA515M, SA6155P, SC7180, SC8180X, SDM670, SDM710, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Qualcomm25 products
1 vendor · 25 products
References
2 links- www.qualcomm.com/company/product-security/bulletins/august-2020-bulletinX Refsource CONFIRMBroken Link