CVE-2020-11286: Buffer Overflow

Published Feb 1, 2021

Updated

An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard request categories like device, interface & endpoint are made together. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Affected Software

136 affected components

Google Android

Qualcomm Apq8009

Qualcomm Apq8009w

Qualcomm Apq8017

Qualcomm Apq8053

Qualcomm Apq8064au

Qualcomm Apq8076

Qualcomm APQ8096AU

Qualcomm Ar8151

Qualcomm Csr6030

Qualcomm MDM9206

Qualcomm Mdm9230

Qualcomm Mdm9250

Qualcomm Mdm9330

Qualcomm MDM9607

Qualcomm Mdm9626

Qualcomm Mdm9628

Qualcomm Mdm9630

Qualcomm MDM9640

Qualcomm MDM9650

Qualcomm MDM9655

Qualcomm MSM8909W

Qualcomm MSM8937

Qualcomm MSM8996AU

Qualcomm Pm660

Qualcomm Pm660a

Qualcomm Pm660l

Qualcomm Pm8004

Qualcomm Pm8005

Qualcomm Pm8909

Qualcomm Pm8916

Qualcomm Pm8937

Qualcomm Pm8952

Qualcomm Pm8953

Qualcomm Pm8956

Qualcomm Pm8996

Qualcomm Pm8998

Qualcomm Pmd9607

Qualcomm Pmd9635

Qualcomm Pmd9645

Qualcomm Pmd9655

Qualcomm Pmi8937

Qualcomm Pmi8952

Qualcomm Pmi8994

Qualcomm Pmi8996

Qualcomm Pmi8998

Qualcomm Pmk8001

Qualcomm Pmm8996au

Qualcomm Pmx20

Qualcomm Qat3514

Qualcomm Qat3522

Qualcomm Qat3550

Qualcomm Qbt1000

Qualcomm Qbt1500

Qualcomm Qca6174

Qualcomm QCA6174A

Qualcomm Qca6310

Qualcomm Qca6320

Qualcomm Qca6564a

Qualcomm Qca6564au

Qualcomm QCA6574

Qualcomm Qca6574a

Qualcomm QCA6574AU

Qualcomm QCA6584

Qualcomm QCA6584AU

Qualcomm Qca9367

Qualcomm QCA9377

Qualcomm Qet4100

Qualcomm Qet4101

Qualcomm Qet4200aq

Qualcomm Qfe1035

Qualcomm Qfe1040

Qualcomm Qfe1045

Qualcomm Qfe2340

Qualcomm Qfe2550

Qualcomm Qfe3100

Qualcomm Qfe3320

Qualcomm Qfe3335

Qualcomm Qfe3345

Qualcomm Qln1021aq

Qualcomm Qln1030

Qualcomm Qln1031

Qualcomm Qln1036aq

Qualcomm Qpa4340

Qualcomm Qpa4360

Qualcomm Qpa5460

Qualcomm Qsw8573

Qualcomm Qtc800h

Qualcomm Qtc800s

Qualcomm Qtc800t

Qualcomm Rgr7640au

Qualcomm Rsw8577

Qualcomm SD 636

Qualcomm Sd205

Qualcomm Sd210

Qualcomm Sd660

Qualcomm Sd820

Qualcomm Sd821

Qualcomm Sd835

Qualcomm SDM630

Qualcomm Sdr660

Qualcomm Sdw2500

Qualcomm Sdw3100

Qualcomm SDX20

Qualcomm Sdx20m

Qualcomm Smb1350

Qualcomm Smb1351

Qualcomm Smb1357

Qualcomm Smb1358

Qualcomm Smb1360

Qualcomm Smb1380

Qualcomm Smb231

Qualcomm Smb358s

Qualcomm Wcd9306

Qualcomm Wcd9326

Qualcomm Wcd9330

Qualcomm Wcd9335

Qualcomm Wcd9340

Qualcomm Wcd9341

Qualcomm Wcn3610

Qualcomm Wcn3615

Qualcomm Wcn3620

Qualcomm Wcn3660b

Qualcomm Wcn3680b

Qualcomm Wcn3980

Qualcomm Wcn3990

Qualcomm Wgr7640

Qualcomm Wsa8810

Qualcomm Wsa8815

Qualcomm Wtr2955

Qualcomm Wtr2965

Qualcomm Wtr3905

Qualcomm Wtr3925

Qualcomm Wtr3950

Qualcomm Wtr4905

Qualcomm Wtr5975

Remediation

Patch Available

https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletin

Event History

Feb 1, 2021

CVE Published

via Android·12:00 AM

Feb 22, 2021

CVE Published

via MITRE·06:26 AM

Data Sourced

via MITRE·06:26 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-11286?

CVE-2020-11286 has been classified as a high-severity vulnerability due to the potential for unauthorized access and data manipulation.

How do I fix CVE-2020-11286?

To address CVE-2020-11286, ensure that all affected Qualcomm devices are updated with the latest firmware provided by the vendor.

Which devices are affected by CVE-2020-11286?

CVE-2020-11286 affects a range of Qualcomm Snapdragon devices, including models from the Automotive, Consumer IoT, Industrial IoT, and Mobile categories.

What causes CVE-2020-11286?

CVE-2020-11286 is caused by an untrusted pointer dereference that occurs during USB control transfers when multiple requests of different categories are made simultaneously.

Is CVE-2020-11286 actively exploited?

As of the last updates, there is no public indication that CVE-2020-11286 is being actively exploited in the wild.