CVE-2020-11212

Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Auto, Snapdragon Compute, Snapdragon…

published January 21, 2021

CVSS
—
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

⚠️ Oops! A sneaky out-of-bounds read can sneak through if the length check for NAN beacons isn't done right. Imagine a waiter miscalculating the table number and serving food to the wrong party! 🍽️ Just like a hotel receptionist who accidentally gives out room keys without verifying the booking, this flaw allows unintended access—reading data that shouldn't be visible. It’s like leaving a window open in a secure building; anyone can peek in! An attacker could potentially exploit this to access sensitive information that shouldn't be disclosed, like peeking at a confidential guest list through a crack in the door. While not actively exploited, this vulnerability could still pose significant risks if layered with other attacks!

Put simply

Just like a hotel receptionist who accidentally gives out room keys without verifying the booking, this flaw allows unintended access—reading data that shouldn't be visible. It’s like leaving a window open in a secure building; anyone can peek in! This vulnerability arises from improper length checks while parsing attributes in NAN beacons across various Snapdragon platforms, leading to the possibility of reading out-of-bounds memory. Quite simply, it opens the door for unintended data exposure.

What to do

An attacker could potentially exploit this to access sensitive information that shouldn't be disclosed, like peeking at a confidential guest list through a crack in the door. While not actively exploited, this vulnerability could still pose significant risks if layered with other attacks! To secure your systems, ensure you're running the latest firmware updates provided by Qualcomm for your Snapdragon devices. Regularly monitor for updates and apply necessary patches to mitigate any potential risks. You’ve got this! With a few updates, you can keep your systems safe and sound. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00884 · 58.8th percentile
Published
2021-01-21T09:41Z
EPSS history
Timeline
  • 21 JAN 09:41Z
    Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Auto, Snapdragon Compute, Snapdragon…
    cvelistv5