^{CVE-2020-11162:}Buffer Overflow Vulnerability in Qualcomm MHI Driver (CVE-2020-11162)

Overview

CVE-2020-11162 is a classic buffer overflow vulnerability (CWE-120) affecting the MHI driver in numerous Qualcomm Snapdragon processors across multiple product lines including Automotive, Compute, Mobile, IoT, and Networking devices. The vulnerability stems from inadequate validation of input parameters for EOT events received from the MHI device side. If exploited, this vulnerability could allow an attacker to overflow buffers, potentially leading to memory corruption, arbitrary code execution, or system crashes. This vulnerability affects a wide range of Qualcomm chipsets including but not limited to SDM710, SDM845, SM8150, SM8250, and many others across various Snapdragon product families.

Remediation

Users and device manufacturers should apply the security patches provided by Qualcomm in their October 2020 Security Bulletin. Device manufacturers who incorporate affected Snapdragon processors should update their firmware with the patches provided by Qualcomm. End users should install all security updates provided by their device manufacturers as soon as they become available. If patches are not available for your specific device, consider implementing network-level protections to minimize exposure and monitor for unusual system behavior.

References

1. Qualcomm Security Bulletin (October 2020): https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin
2. Common Weakness Enumeration (CWE-120): Buffer Copy without Checking Size of Input
3. Affected chipsets include: Agatti, APQ8009, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCA6390, QCM2150, QCS404, QCS405, QCS605, QM215, QRB5165, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130