CVE-2019-14025
First published: Mon Aug 03 2020(Updated: )
u'When a new session is created, Object is returned that contains TZ addresses and it get passed to HLOS as an handle to refer to a particular session and can cause TZ to jump to a invalid address' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, QCS610, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130
Credit: product-security@qualcomm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Qcs404 Firmware | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Rennell Firmware | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Sdx55 Firmware | ||
| Qualcomm Sdx55 | ||
| Qualcomm Sm6150 Firmware | ||
| Qualcomm Sm6150 | ||
| Qualcomm Sm7150 Firmware | ||
| Qualcomm Sm7150 | ||
| Qualcomm Sm8250 Firmware | ||
| Qualcomm SM8250 | ||
| Qualcomm Sxr2130 Firmware | ||
| Qualcomm Sxr2130 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
- https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin
- https://source.android.com/docs/security/bulletin/2020-08-01/#asterisk
- https://source.android.com/docs/security/bulletin/2020-08-01 (Advisory)
Frequently Asked Questions
What is CVE-2019-14025?
CVE-2019-14025 is a vulnerability in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon that allows an invalid address to be jumped to in the Trusted Execution Environment (TEE).
Which software is affected by CVE-2019-14025?
Google Android, Qualcomm Kamorta Firmware, Qualcomm Qcs404 Firmware, Qualcomm Qcs610 Firmware, Qualcomm Rennell Firmware, Qualcomm Sc7180 Firmware, Qualcomm Sdx55 Firmware, Qualcomm Sm6150 Firmware, Qualcomm Sm7150 Firmware, Qualcomm Sm8250 Firmware, Qualcomm Sxr2130 Firmware.
What is the severity rating of CVE-2019-14025?
CVE-2019-14025 has a severity rating of 5.5 (High).
How can I fix CVE-2019-14025?
To fix CVE-2019-14025, apply the necessary security patches provided by the software vendors or follow the guidance provided in the official bulletins.
Where can I find more information about CVE-2019-14025?
You can find more information about CVE-2019-14025 in the official bulletins from Qualcomm and the Android Security Bulletin for August 2020.
- agent/references
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/android-source
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- vendor/google
- canonical/google android
- vendor/qualcomm
- canonical/qualcomm qcs404 firmware
- canonical/qualcomm rennell firmware
- canonical/qualcomm sdx55 firmware
- canonical/qualcomm sdx55
- canonical/qualcomm sm6150 firmware
- canonical/qualcomm sm6150
- canonical/qualcomm sm7150 firmware
- canonical/qualcomm sm7150
- canonical/qualcomm sm8250 firmware
- canonical/qualcomm sm8250
- canonical/qualcomm sxr2130 firmware
- canonical/qualcomm sxr2130