CVE-2020-11152: Use After Free

Published Jan 21, 2021

Updated

Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between accessing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Affected Software

160 affected components

Qualcomm Apq8009w

Qualcomm Apq8017

Qualcomm Apq8037

Qualcomm Apq8052

Qualcomm Apq8053

Qualcomm Apq8056

Qualcomm Apq8076

Qualcomm APQ8096AU

Qualcomm Aqt1000

Qualcomm Ar8031

Qualcomm Csra6620

Qualcomm Csra6640

Qualcomm MSM8909W

Qualcomm Msm8916

Qualcomm MSM8917

Qualcomm Msm8920

Qualcomm MSM8937

Qualcomm Msm8940

Qualcomm MSM8952

Qualcomm Msm8953

Qualcomm Msm8956

Qualcomm MSM8976

Qualcomm Msm8976sg

Qualcomm MSM8996AU

Qualcomm Pm439

Qualcomm Pm660

Qualcomm Pm660a

Qualcomm Pm660l

Qualcomm Pm670

Qualcomm Pm670a

Qualcomm Pm670l

Qualcomm Pm8004

Qualcomm Pm8005

Qualcomm Pm855

Qualcomm Pm855a

Qualcomm Pm855b

Qualcomm Pm855l

Qualcomm Pm855p

Qualcomm Pm8916

Qualcomm Pm8937

Qualcomm Pm8940

Qualcomm Pm8952

Qualcomm Pm8953

Qualcomm Pm8956

Qualcomm Pm8998

Qualcomm Pmd9655

Qualcomm Pmi632

Qualcomm Pmi8937

Qualcomm Pmi8952

Qualcomm Pmi8998

Qualcomm Pmm8996au

Qualcomm Pmx24

Qualcomm Pmx50

Qualcomm Qat3514

Qualcomm Qat3522

Qualcomm Qat3550

Qualcomm Qbt1000

Qualcomm Qbt1500

Qualcomm Qbt2000

Qualcomm QCA6174A

Qualcomm Qca6310

Qualcomm Qca6320

Qualcomm Qca6420

Qualcomm Qca6430

Qualcomm Qca6564a

Qualcomm Qca6564au

Qualcomm Qca6574a

Qualcomm QCA6574AU

Qualcomm QCA6584AU

Qualcomm Qca8337

Qualcomm QCA9377

Qualcomm Qcc1110

Qualcomm QCS405

Qualcomm Qcs603

Qualcomm QCS605

Qualcomm Qet4100

Qualcomm Qet4101

Qualcomm Qet5100

Qualcomm Qet5100m

Qualcomm Qfe2080fc

Qualcomm Qfe2081fc

Qualcomm Qfe2082fc

Qualcomm Qfe2101

Qualcomm Qfe2550

Qualcomm Qfe3100

Qualcomm Qfe3440fc

Qualcomm Qfe4301

Qualcomm Qfe4302

Qualcomm Qfe4303

Qualcomm Qfe4305

Qualcomm Qfe4308

Qualcomm Qfe4309

Qualcomm Qfe4320

Qualcomm Qfe4373fc

Qualcomm Qfe4455fc

Qualcomm Qfe4465fc

Qualcomm Qln1035bd

Qualcomm Qpa4340

Qualcomm Qpa4360

Qualcomm Qpa5460

Qualcomm Qsw8573

Qualcomm Qtc800h

Qualcomm Qtc800s

Qualcomm Qtc800t

Qualcomm Qtc801s

Qualcomm Rgr7640au

Qualcomm Rsw8577

Qualcomm Sd439

Qualcomm Sd450

Qualcomm Sd636

Qualcomm Sd660

Qualcomm Sd710

Qualcomm Sd712

Qualcomm Sd835

Qualcomm Sd855

Qualcomm Sd8cx

Qualcomm SDM630

Qualcomm Sdm830

Qualcomm Sdr051

Qualcomm Sdr052

Qualcomm Sdr660

Qualcomm Sdr8150

Qualcomm Sdw2500

Qualcomm Sdw3100

Qualcomm SDX24

Qualcomm Sdx50m

Qualcomm Smb1351

Qualcomm Smb1355

Qualcomm Smb1358

Qualcomm Smb1360

Qualcomm Smb1380

Qualcomm Smb1381

Qualcomm Smb1390

Qualcomm Smb231

Qualcomm Wcd9306

Qualcomm Wcd9326

Qualcomm Wcd9330

Qualcomm Wcd9335

Qualcomm Wcd9340

Qualcomm Wcd9341

Qualcomm Wcd9360

Qualcomm Wcn3610

Qualcomm Wcn3615

Qualcomm Wcn3620

Qualcomm Wcn3660b

Qualcomm Wcn3680b

Qualcomm Wcn3950

Qualcomm Wcn3980

Qualcomm Wcn3990

Qualcomm Wcn3998

Qualcomm Wcn3999

Qualcomm Wgr7640

Qualcomm Whs9410

Qualcomm Wsa8810

Qualcomm Wsa8815

Qualcomm Wtr2955

Qualcomm Wtr2965

Qualcomm Wtr3925

Qualcomm Wtr4905

Qualcomm Wtr5975

Remediation

Patch Available

https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin

Event History

Jan 21, 2021

CVE Published

via MITRE·09:41 AM

Data Sourced

via MITRE·09:41 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-11152?

CVE-2020-11152 has been classified with a medium severity rating.

How do I fix CVE-2020-11152?

To fix CVE-2020-11152, apply the security patches provided by Qualcomm in their December 2020 security bulletin.

Which devices are affected by CVE-2020-11152?

CVE-2020-11152 affects various Qualcomm Snapdragon chipsets used in automotive, consumer IoT, and mobile devices.

Can CVE-2020-11152 be exploited remotely?

Yes, CVE-2020-11152 can potentially be exploited remotely due to its nature as a race condition in the HAL layer.

What types of products use the affected Qualcomm components in CVE-2020-11152?

Products using Snapdragon Auto, Snapdragon Compute, mobile phones, and certain IoT devices are likely to be impacted by CVE-2020-11152.