CVE-2020-11298: qualcomm aqt1000_firmware

Vulnerability summary

CVE-2020-11298 is a high (CVSS 7.8) vulnerability in qualcomm aqt1000_firmware. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.7% of scored vulnerabilities.

Timeline

1. 09-06-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to secure kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.