CVE-2019-10524: Use After Free
Lack of check for a negative value returned for getclk is wrongly interpreted as valid pointer and lead to use after free in clk driver in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10524?
CVE-2019-10524 has been rated as a high severity vulnerability due to the use after free condition it introduces.
How do I fix CVE-2019-10524?
The fix for CVE-2019-10524 involves applying a patch that validates the return value of the get_clk function to prevent negative values.
Which devices are affected by CVE-2019-10524?
CVE-2019-10524 affects various Qualcomm Snapdragon devices including MDM9150, MDM9206, and several others across different categories.
What impact does CVE-2019-10524 have on devices?
CVE-2019-10524 could potentially allow attackers to execute arbitrary code or trigger a denial of service on affected devices.
Is my Qualcomm-based device vulnerable to CVE-2019-10524?
If your Qualcomm device uses the affected firmware versions outlined in CVE-2019-10524, it may be vulnerable until the necessary updates are applied.