CVE-2020-3699: Critical severity Qualcomm Apq8009 Firmware vulnerability
Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCM2150, QCN7605, QCS405, QCS605, QM215, SA6155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/vendor/qcom-opensource/wlan/qcacld-2.0to a version that resolves this vulnerability.Fixed in SoCVersion:2020-07-05 - Upgrade
Upgrade
android/platform/vendor/qcom-opensource/wlan/qcacld-3.0to a version that resolves this vulnerability.Fixed in SoCVersion:2020-07-05
Event History
Frequently Asked Questions
What is the severity of CVE-2020-3699?
CVE-2020-3699 has a high severity rating due to potential out-of-bounds access vulnerabilities.
How do I fix CVE-2020-3699?
To fix CVE-2020-3699, update the affected Qualcomm firmware or Android version to the latest release.
Which products are affected by CVE-2020-3699?
CVE-2020-3699 affects various Qualcomm products, including certain Snapdragon chipsets and their respective firmware.
What kind of attack can exploit CVE-2020-3699?
An attacker could exploit CVE-2020-3699 to execute arbitrary code or cause a system crash through out-of-bounds access.
Is CVE-2020-3699 specific to Android devices?
While CVE-2020-3699 primarily impacts Android devices, it also affects other Qualcomm-based hardware platforms.