CVE-2019-2298: Use After Free
Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDM660, SDX20, SDX24
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2019-2298.
What is the severity level of CVE-2019-2298?
The severity level of CVE-2019-2298 is high with a CVSS score of 7.8.
Which software products are affected by CVE-2019-2298?
CVE-2019-2298 affects Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCS405, QCS605, SD 210, SD 212, SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712, SD 710, SD 670, SD 820, SD 820a, SD 845, SD 850, SD 855, and Sdm660 firmware.
How can I fix CVE-2019-2298?
To fix CVE-2019-2298, it is recommended to apply the security patches provided by Qualcomm. Please refer to the official Qualcomm Product Security Bulletins for the specific updates.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The CWE ID for CVE-2019-2298 is CWE-416.