Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Qualcomm firmware can cause system crash via memory read

CVE-2019-2318 · published 6 years ago
Summary

The non‑secure part of Qualcomm APQ8017, APQ8053, APQ8096, APQ8096AU and IPQ8074 firmware can trigger the secure TrustZone component to read any area of memory, leading to a crash that stops the device from working. This may affect devices such as cars, IoT gadgets, phones and networking equipment that use these chipsets. Install the latest firmware updates from Qualcomm as soon as they are available to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm apq8017_firmware All versions
cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*
qualcomm apq8053_firmware All versions
cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*
qualcomm apq8096_firmware All versions
cpe:2.3:o:qualcomm:apq8096_firmware:-:*:*:*:*:*:*:*
qualcomm apq8096au_firmware All versions
cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*
qualcomm ipq8074_firmware All versions
cpe:2.3:o:qualcomm:ipq8074_firmware:-:*:*:*:*:*:*:*
qualcomm msm8917_firmware All versions
cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:*
qualcomm msm8920_firmware All versions
cpe:2.3:o:qualcomm:msm8920_firmware:-:*:*:*:*:*:*:*
qualcomm msm8937_firmware All versions
cpe:2.3:o:qualcomm:msm8937_firmware:-:*:*:*:*:*:*:*
qualcomm msm8940_firmware All versions
cpe:2.3:o:qualcomm:msm8940_firmware:-:*:*:*:*:*:*:*
qualcomm msm8953_firmware All versions
cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*
qualcomm msm8996_firmware All versions
cpe:2.3:o:qualcomm:msm8996_firmware:-:*:*:*:*:*:*:*
qualcomm msm8996au_firmware All versions
cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
qualcomm qca8081_firmware All versions
cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*
qualcomm qm215_firmware All versions
cpe:2.3:o:qualcomm:qm215_firmware:-:*:*:*:*:*:*:*
qualcomm sdm429_firmware All versions
cpe:2.3:o:qualcomm:sdm429_firmware:-:*:*:*:*:*:*:*
qualcomm sdm439_firmware All versions
cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:*
qualcomm sdm450_firmware All versions
cpe:2.3:o:qualcomm:sdm450_firmware:-:*:*:*:*:*:*:*
qualcomm sdm632_firmware All versions
cpe:2.3:o:qualcomm:sdm632_firmware:-:*:*:*:*:*:*:*
qualcomm snapdragon_high_med_2016_firmware All versions
cpe:2.3:o:qualcomm:snapdragon_high_med_2016_firmware:-:*:*:*:*:*:*:*
Original advisory text
Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snap...
Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8017, APQ8053, APQ8096, APQ8096AU, IPQ8074, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, QCA8081, QM215, SDM429, SDM439, SDM450, SDM632, Snapdragon_High_Med_2016
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published21 Nov 2019
Updated26 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-2318 · NVD
Track software like this
Free during beta