CVE-2019-10622

Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon…

published April 16, 2020

CVSS
—
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

⚠️ A silent memory mishap is lurking in the Snapdragon family! An out-of-bounds memory access can spring to life while parsing ADSP messages—yikes! 🤖 Think of it like a café that accepts orders without checking if the kitchen has enough supplies. If a customer requests an item that's not in stock, they could end up with a surprise—it could be a delightful cupcake or a disastrous mess! In the wrong hands, this vulnerability could lead to unpredictable behavior in the system, potentially crashing applications or allowing unauthorized access. While nothing is known to be exploited yet, it could still pose a risk in specific scenarios. We don't want our devices serving up something unexpected, do we? 🔥

Put simply

Think of it like a café that accepts orders without checking if the kitchen has enough supplies. If a customer requests an item that's not in stock, they could end up with a surprise—it could be a delightful cupcake or a disastrous mess! This vulnerability occurs due to a lack of size checks on payloads received from userspace, allowing for out-of-bounds memory access while processing ADSP messages in various Snapdragon chipsets.

What to do

In the wrong hands, this vulnerability could lead to unpredictable behavior in the system, potentially crashing applications or allowing unauthorized access. While nothing is known to be exploited yet, it could still pose a risk in specific scenarios. We don't want our devices serving up something unexpected, do we? 🔥 To mitigate this risk, ensure you're running the latest firmware update that addresses this issue. Regularly check for security patches from Qualcomm, and consider implementing additional integrity checks in your software to safeguard against unexpected payload sizes. You've got this! Stay vigilant and update your systems—your devices will thank you! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.6th percentile
Published
2020-04-16T10:46Z
EPSS history
Timeline
  • 16 APR 10:46Z
    Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon…
    cvelistv5