CVE-2019-10484

Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previous command teardwon sequence in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8098, MSM8909W, Nicobar, QCS405, QCS605, SDA845, SDM660, SDM670, SDM710, SDM845, SDX24, SM6150, SM7150, SM8150, SM8250, SXR2130

Score

CVSS 3.1 5.5 Medium

Status

Modified - product-security@qualcomm.com

Published

2019-12-12

Last modified

2024-08-04

Weaknesses

CWE-416

Affected products

• Apq8098 Firmware (Qualcomm)
• Msm8909w Firmware (Qualcomm)
• Nicobar Firmware (Qualcomm)
• Qcs405 Firmware (Qualcomm)
• Qcs605 Firmware (Qualcomm)
• Sda845 Firmware (Qualcomm)
• Sdm660 Firmware (Qualcomm)
• Sdm670 Firmware (Qualcomm)
• Sdm710 Firmware (Qualcomm)
• Sdm845 Firmware (Qualcomm)
• Sdx24 Firmware (Qualcomm)
• Sm6150 Firmware (Qualcomm)
• Sm7150 Firmware (Qualcomm)
• Sm8150 Firmware (Qualcomm)
• Sm8250 Firmware (Qualcomm)
• Sxr2130 Firmware (Qualcomm)
• Snapdragon Auto (Qualcomm Inc.)
• Snapdragon Compute (Qualcomm Inc.)
• Snapdragon Consumer Iot (Qualcomm Inc.)
• Snapdragon Industrial Iot (Qualcomm Inc.)
• Snapdragon Mobile (Qualcomm Inc.)
• Snapdragon Voice Music (Qualcomm Inc.)
• Snapdragon Wearables (Qualcomm Inc.)

References

• https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin