Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payload size received in Snapdragon Auto, Snapdragon Compute, ...

CVE-2019-14021 · published 6 years ago
Summary

Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payload size received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8096A...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm apq8096au_firmware All versions
cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*
qualcomm apq8098_firmware All versions
cpe:2.3:o:qualcomm:apq8098_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9150_firmware All versions
cpe:2.3:o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9206_firmware All versions
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9607_firmware All versions
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9640_firmware All versions
cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9650_firmware All versions
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
qualcomm msm8905_firmware All versions
cpe:2.3:o:qualcomm:msm8905_firmware:-:*:*:*:*:*:*:*
qualcomm msm8909_firmware All versions
cpe:2.3:o:qualcomm:msm8909_firmware:-:*:*:*:*:*:*:*
qualcomm msm8909w_firmware All versions
cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*
qualcomm msm8917_firmware All versions
cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:*
qualcomm msm8920_firmware All versions
cpe:2.3:o:qualcomm:msm8920_firmware:-:*:*:*:*:*:*:*
qualcomm msm8937_firmware All versions
cpe:2.3:o:qualcomm:msm8937_firmware:-:*:*:*:*:*:*:*
qualcomm msm8940_firmware All versions
cpe:2.3:o:qualcomm:msm8940_firmware:-:*:*:*:*:*:*:*
qualcomm msm8953_firmware All versions
cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*
qualcomm msm8996au_firmware All versions
cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
qualcomm msm8998_firmware All versions
cpe:2.3:o:qualcomm:msm8998_firmware:-:*:*:*:*:*:*:*
qualcomm nicobar_firmware All versions
cpe:2.3:o:qualcomm:nicobar_firmware:-:*:*:*:*:*:*:*
qualcomm qcm2150_firmware All versions
cpe:2.3:o:qualcomm:qcm2150_firmware:-:*:*:*:*:*:*:*
qualcomm qcs605_firmware All versions
cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*
qualcomm qm215_firmware All versions
cpe:2.3:o:qualcomm:qm215_firmware:-:*:*:*:*:*:*:*
qualcomm rennell_firmware All versions
cpe:2.3:o:qualcomm:rennell_firmware:-:*:*:*:*:*:*:*
qualcomm sc7180_firmware All versions
cpe:2.3:o:qualcomm:sc7180_firmware:-:*:*:*:*:*:*:*
qualcomm sc8180x_firmware All versions
cpe:2.3:o:qualcomm:sc8180x_firmware:-:*:*:*:*:*:*:*
qualcomm sda660_firmware All versions
cpe:2.3:o:qualcomm:sda660_firmware:-:*:*:*:*:*:*:*
qualcomm sda845_firmware All versions
cpe:2.3:o:qualcomm:sda845_firmware:-:*:*:*:*:*:*:*
qualcomm sdm429_firmware All versions
cpe:2.3:o:qualcomm:sdm429_firmware:-:*:*:*:*:*:*:*
qualcomm sdm429w_firmware All versions
cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*
qualcomm sdm439_firmware All versions
cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:*
qualcomm sdm450_firmware All versions
cpe:2.3:o:qualcomm:sdm450_firmware:-:*:*:*:*:*:*:*
qualcomm sdm630_firmware All versions
cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*
qualcomm sdm632_firmware All versions
cpe:2.3:o:qualcomm:sdm632_firmware:-:*:*:*:*:*:*:*
qualcomm sdm636_firmware All versions
cpe:2.3:o:qualcomm:sdm636_firmware:-:*:*:*:*:*:*:*
qualcomm sdm660_firmware All versions
cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
qualcomm sdm670_firmware All versions
cpe:2.3:o:qualcomm:sdm670_firmware:-:*:*:*:*:*:*:*
qualcomm sdm710_firmware All versions
cpe:2.3:o:qualcomm:sdm710_firmware:-:*:*:*:*:*:*:*
qualcomm sdm845_firmware All versions
cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
qualcomm sdm850_firmware All versions
cpe:2.3:o:qualcomm:sdm850_firmware:-:*:*:*:*:*:*:*
qualcomm sdx20_firmware All versions
cpe:2.3:o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*
qualcomm sdx24_firmware All versions
cpe:2.3:o:qualcomm:sdx24_firmware:-:*:*:*:*:*:*:*
qualcomm sdx55_firmware All versions
cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*
qualcomm sm6150_firmware All versions
cpe:2.3:o:qualcomm:sm6150_firmware:-:*:*:*:*:*:*:*
qualcomm sm7150_firmware All versions
cpe:2.3:o:qualcomm:sm7150_firmware:-:*:*:*:*:*:*:*
qualcomm sm8150_firmware All versions
cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*
qualcomm sxr1130_firmware All versions
cpe:2.3:o:qualcomm:sxr1130_firmware:-:*:*:*:*:*:*:*
Original advisory text
Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payload size received in Snapdragon Auto, Snapdragon Compute, ...
Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payload size received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
Timeline
Published16 Apr 2020
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-14021 · NVD
Track software like this
Free during beta