CVE-2020-3665: Out-of-bounds Read
First published: Mon Jun 01 2020(Updated: )
A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firmware being out of range in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996, MSM8996AU, QCA6174A, QCA9377, QCA9379, SDM439, SDM636, SDM660, SDX20, SDX24, SM8150
Credit: product-security@qualcomm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | ||
| Google Android | ||
| Qualcomm Apq8009 | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Mdm9206 Firmware | ||
| Qualcomm Mdm9206 | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Mdm9607 | ||
| Qualcomm Mdm9615 Firmware | ||
| Google Android | ||
| Qualcomm Mdm9640 Firmware | ||
| Qualcomm Mdm9640 | ||
| Qualcomm Mdm9650 Firmware | ||
| Qualcomm Mdm9650 | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Msm8996 Firmware | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Msm8996au | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Google Android | ||
| Qualcomm Sdm439 Firmware | ||
| Qualcomm Sdm439 | ||
| Google Android | ||
| Qualcomm Sdm636 | ||
| Qualcomm Sdm660 Firmware | ||
| Qualcomm Sdm660 | ||
| Google Android | ||
| Qualcomm Sdx20 | ||
| Qualcomm Sdx24 Firmware | ||
| Google Android | ||
| Qualcomm Sm8150 Firmware | ||
| Qualcomm Sm8150 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
- https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin
- https://source.codeaurora.org/quic/le/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=48b55d5182ec223d1e1f88dc1b7b7ef91f3459c8
- https://source.android.com/docs/security/bulletin/2020-06-01 (Advisory)
Frequently Asked Questions
What is CVE-2020-3665?
CVE-2020-3665 is a vulnerability that could lead to a possible buffer overflow while processing commands from firmware.
Which software products are affected by CVE-2020-3665?
Google Android and Qualcomm firmware are affected by CVE-2020-3665.
What is the severity rating of CVE-2020-3665?
CVE-2020-3665 has a severity rating of 7.8 (high).
How can I fix CVE-2020-3665?
To fix CVE-2020-3665, it is recommended to follow the security bulletins and patches provided by Google and Qualcomm.
Where can I find more information about CVE-2020-3665?
More information about CVE-2020-3665 can be found in the references provided by Code Aurora, Android Security Bulletin, and Qualcomm.
- collector/nvd-index
- collector/android-source
- agent/author
- agent/severity
- agent/type
- agent/event
- vendor/qualcomm
- canonical/google android
- canonical/qualcomm apq8009
- canonical/qualcomm mdm9206 firmware
- canonical/qualcomm mdm9206
- canonical/qualcomm mdm9607
- canonical/qualcomm mdm9615 firmware
- canonical/qualcomm mdm9640 firmware
- canonical/qualcomm mdm9640
- canonical/qualcomm mdm9650 firmware
- canonical/qualcomm mdm9650
- canonical/qualcomm msm8996 firmware
- canonical/qualcomm msm8996au
- canonical/qualcomm sdm439 firmware
- canonical/qualcomm sdm439
- canonical/qualcomm sdm636
- canonical/qualcomm sdm660 firmware
- canonical/qualcomm sdm660
- canonical/qualcomm sdx20
- canonical/qualcomm sdx24 firmware
- canonical/qualcomm sm8150 firmware
- canonical/qualcomm sm8150
- vendor/google