CVE-2020-11171

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon…

published March 17, 2021

CVSS
—
EPSS
1%
Percentile
61.1
In the wild
Unconfirmed
What it is

⚠️ A lack of NULL termination could lead to some sneaky buffer over-reads in Snapdragon devices! Think of this as a chef trying to serve a dish without knowing when it’s finished cooking — if they don’t check for that last ingredient, they might end up serving a messy, half-done plate instead! If exploited, attackers could potentially read sensitive information from memory that should have remained hidden. While there’s no current exploit in the wild, the absence of safeguards leaves doors open for sneaky shenanigans, leading to compromised device security.

Put simply

Think of this as a chef trying to serve a dish without knowing when it’s finished cooking — if they don’t check for that last ingredient, they might end up serving a messy, half-done plate instead! This vulnerability occurs in various Snapdragon devices due to a failure to properly check for NULL termination in received SDP values, allowing for unexpected memory reads where sensitive data might reside.

What to do

If exploited, attackers could potentially read sensitive information from memory that should have remained hidden. While there’s no current exploit in the wild, the absence of safeguards leaves doors open for sneaky shenanigans, leading to compromised device security. To mitigate this issue, ensure that your firmware is updated to the latest version provided by Qualcomm. Additionally, review your system configurations for any other potential risks stemming from unvalidated inputs. You've got this! Stay proactive, and keep your devices secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00959 · 61.1th percentile
Published
2021-03-17T06:00Z
EPSS history
Timeline
  • 17 MAR 06:00Z
    Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon…
    cvelistv5