CVE-2020-11144

Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon Auto, Snapdragon…

published January 21, 2021

CVSS
—
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

⚠️ A sneaky buffer over-read could lead to unexpected behavior in devices using Snapdragon tech! Think of this as a restaurant that serves you a meal without checking the portion size, resulting in some nasty surprises. 🤔 Imagine a kitchen that prepares meals but forgets to measure the ingredients. If they miscalculate the amount of seasoning, it could ruin the dish—or in this case, lead to unpredictable outcomes when processing invalid data packets. This vulnerability could allow an attacker to cause instability in devices, potentially exposing sensitive information or leading to crashes. While it's not currently known to be exploited, the implications are concerning for devices relying on the affected Snapdragon systems. 📉

Put simply

Imagine a kitchen that prepares meals but forgets to measure the ingredients. If they miscalculate the amount of seasoning, it could ruin the dish—or in this case, lead to unpredictable outcomes when processing invalid data packets. The vulnerability exists due to a lack of size checks when decompressing invalid ROHC packets in various Snapdragon platforms. This oversight results in a buffer over-read, allowing for unexpected data handling.

What to do

This vulnerability could allow an attacker to cause instability in devices, potentially exposing sensitive information or leading to crashes. While it's not currently known to be exploited, the implications are concerning for devices relying on the affected Snapdragon systems. 📉 To mitigate this risk, implement security patches as soon as they are available from Qualcomm. Regularly monitor your devices for updates and audit configurations to ensure that proper checks are in place for packet sizes. You've got this! Stay vigilant and keep your systems updated for maximum security! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Published
2021-01-21T09:41Z
EPSS history
Timeline
  • 21 JAN 09:41Z
    Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon Auto, Snapdragon…
    cvelistv5