CVE-2019-14083

While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified in the attribute…

published March 5, 2020

CVSS
—
EPSS
1%
Percentile
61.1
In the wild
Unconfirmed
What it is

⚠️ An integer underflow could turn your device into a digital magician, making data disappear faster than you can say 'Snapdragon'! Think of it as a waiter misreading a table's order and accidentally serving one customer a whole platter of food meant for another. If the length isn't properly checked, it can cause unexpected behavior, leading to potential chaos in your system. This vulnerability could allow attackers to manipulate the service descriptor, potentially leading to crashes or erratic behavior in devices. If exploited, it might open the door to further attacks or instability in your IoT devices.

Put simply

Think of it as a waiter misreading a table's order and accidentally serving one customer a whole platter of food meant for another. If the length isn't properly checked, it can cause unexpected behavior, leading to potential chaos in your system. The flaw arises during the parsing of Service Descriptor Extended Attributes in various Snapdragon chipsets, where an incorrect length value can cause an integer underflow, leading to unpredictable and harmful consequences within the system.

What to do

This vulnerability could allow attackers to manipulate the service descriptor, potentially leading to crashes or erratic behavior in devices. If exploited, it might open the door to further attacks or instability in your IoT devices. It's crucial to check for firmware updates from the manufacturers of affected Snapdragon devices. Ensure your devices are running the latest patches, and monitor for any advisories related to this vulnerability. You're on top of your game! Stay vigilant, patch those devices, and keep the digital world safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00958 · 61.1th percentile
Published
2020-03-05T08:56Z
EPSS history
Timeline
  • 05 MAR 08:56Z
    While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified in the attribute…
    cvelistv5