[ CVE-2020-11261 · Published 9 Jun 2021 ]
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS 2%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-12-01
[ Description ]Official description
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 1 Jun 2022): Apply updates per vendor instructions.
- Patch on qualcomm.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- www.qualcomm.com/company/product-security/bulletins/january-2021-bulletinPatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource