title: Use of Out-of-range Pointer Offset in PCIe
description: Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
affected:
{
defaultStatus: unaffected
platforms: [Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Small Cell, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking]
product: Snapdragon
vendor: Qualcomm, Inc.
versions:
status: affected, version: 315 5G IoT Modem
status: affected, version: APQ8017
status: affected, version: AQT1000
status: affected, version: AR8031
status: affected, version: AR8035
status: affected, version: C-V2X 9150
status: affected, version: CSRA6620
status: affected, version: CSRA6640
status: affected, version: CSRB31024
status: affected, version: FastConnect 6200
status: affected, version: FastConnect 6700
status: affected, version: FastConnect 6800
status: affected, version: FastConnect 6900
status: affected, version: FastConnect 7800
status: affected, version: Flight RB5 5G Platform
status: affected, version: FSM20055
status: affected, version: FSM20056
status: affected, version: Immersive Home 214 Platform
status: affected, version: Immersive Home 216 Platform
status: affected, version: Immersive Home 316 Platform
status: affected, version: Immersive Home 318 Platform
status: affected, version: Immersive Home 3210 Platform
status: affected, version: Immersive Home 326 Platform
status: affected, version: IPQ5010
status: affected, version: IPQ6018
status: affected, version: IPQ8074A
status: affected, version: IPQ8174
status: affected, version: IPQ9574
status: affected, version: MDM9628
status: affected, version: QAM8255P
status: affected, version: QAM8295P
status: affected, version: QAM8650P
status: affected, version: QAM8775P
status: affected, version: QAMSRV1H
status: affected, version: QAMSRV1M
status: affected, version: QCA4024
status: affected, version: QCA6174A
status: affected, version: QCA6310
status: affected, version: QCA6335
status: affected, version: QCA6391
status: affected, version: QCA6420
status: affected, version: QCA6421
status: affected, version: QCA6426
status: affected, version: QCA6430
status: affected, version: QCA6431
status: affected, version: QCA6436
status: affected, version: QCA6564A
status: affected, version: QCA6564AU
status: affected, version: QCA6574
status: affected, version: QCA6574A
status: affected, version: QCA6574AU
status: affected, version: QCA6584AU
status: affected, version: QCA6595
status: affected, version: QCA6595AU
status: affected, version: QCA6688AQ
status: affected, version: QCA6696
status: affected, version: QCA6698AQ
status: affected, version: QCA6797AQ
status: affected, version: QCA8072
status: affected, version: QCA8075
status: affected, version: QCA8081
status: affected, version: QCA8337
status: affected, version: QCA9377
status: affected, version: QCC710
status: affected, version: QCM2290
status: affected, version: QCM4290
status: affected, version: QCM4325
status: affected, version: QCM4490
status: affected, version: QCM6125
status: affected, version: QCM6490
status: affected, version: QCM8550
status: affected, version: QCN5022
status: affected, version: QCN5024
status: affected, version: QCN5052
status: affected, version: QCN5054
status: affected, version: QCN5122
status: affected, version: QCN5152
status: affected, version: QCN6024
status: affected, version: QCN6224
status: affected, version: QCN6274
status: affected, version: QCN9000
status: affected, version: QCN9001
status: affected, version: QCN9002
status: affected, version: QCN9003
status: affected, version: QCN9011
status: affected, version: QCN9012
status: affected, version: QCN9024
status: affected, version: QCN9074
status: affected, version: QCN9274
status: affected, version: QCS2290
status: affected, version: QCS410
status: affected, version: QCS4290
status: affected, version: QCS4490
status: affected, version: QCS610
status: affected, version: QCS6125
status: affected, version: QCS6490
status: affected, version: QCS7230
status: affected, version: QCS8155
status: affected, version: QCS8250
status: affected, version: QCS8550
status: affected, version: QDU1000
status: affected, version: QDU1010
status: affected, version: QDU1110
status: affected, version: QDU1210
status: affected, version: QDX1010
status: affected, version: QDX1011
status: affected, version: QEP8111
status: affected, version: QFW7114
status: affected, version: QFW7124
status: affected, version: QRB5165M
status: affected, version: QRB5165N
status: affected, version: QRU1032
status: affected, version: QRU1052
status: affected, version: QRU1062
status: affected, version: QSM8350
status: affected, version: Qualcomm 205 Mobile Platform
status: affected, version: Qualcomm 215 Mobile Platform
status: affected, version: Qualcomm Video Collaboration VC1 Platform
status: affected, version: Qualcomm Video Collaboration VC3 Platform
status: affected, version: Qualcomm Video Collaboration VC5 Platform
status: affected, version: Robotics RB3 Platform
status: affected, version: Robotics RB5 Platform
status: affected, version: SA4150P
status: affected, version: SA4155P
status: affected, version: SA6145P
status: affected, version: SA6150P
status: affected, version: SA6155
status: affected, version: SA6155P
status: affected, version: SA8145P
status: affected, version: SA8150P
status: affected, version: SA8155
status: affected, version: SA8155P
status: affected, version: SA8195P
status: affected, version: SA8255P
status: affected, version: SA8295P
status: affected, version: SA8650P
status: affected, version: SA8770P
status: affected, version: SA8775P
status: affected, version: SA9000P
status: affected, version: SD 8 Gen1 5G
status: affected, version: SD626
status: affected, version: SD660
status: affected, version: SD670
status: affected, version: SD730
status: affected, version: SD855
status: affected, version: SD865 5G
status: affected, version: SD888
status: affected, version: SDM429W
status: affected, version: SDX55
status: affected, version: SG4150P
status: affected, version: SG8275P
status: affected, version: SM4125
status: affected, version: SM6250
status: affected, version: SM7250P
status: affected, version: SM7315
status: affected, version: SM7325P
status: affected, version: SM8550P
status: affected, version: Smart Audio 400 Platform
status: affected, version: Smart Display 200 Platform (APQ5053-AA)
status: affected, version: Snapdragon 210 Processor
status: affected, version: Snapdragon 212 Mobile Platform
status: affected, version: Snapdragon 4 Gen 1 Mobile Platform
status: affected, version: Snapdragon 4 Gen 2 Mobile Platform
status: affected, version: Snapdragon 425 Mobile Platform
status: affected, version: Snapdragon 429 Mobile Platform
status: affected, version: Snapdragon 439 Mobile Platform
status: affected, version: Snapdragon 460 Mobile Platform
status: affected, version: Snapdragon 480 5G Mobile Platform
status: affected, version: Snapdragon 480+ 5G Mobile Platform (SM4350-AC)
status: affected, version: Snapdragon 625 Mobile Platform
status: affected, version: Snapdragon 626 Mobile Platform
status: affected, version: Snapdragon 632 Mobile Platform
status: affected, version: Snapdragon 660 Mobile Platform
status: affected, version: Snapdragon 662 Mobile Platform
status: affected, version: Snapdragon 665 Mobile Platform
status: affected, version: Snapdragon 670 Mobile Platform
status: affected, version: Snapdragon 675 Mobile Platform
status: affected, version: Snapdragon 678 Mobile Platform (SM6150-AC)
status: affected, version: Snapdragon 680 4G Mobile Platform
status: affected, version: Snapdragon 685 4G Mobile Platform (SM6225-AD)
status: affected, version: Snapdragon 690 5G Mobile Platform
status: affected, version: Snapdragon 695 5G Mobile Platform
status: affected, version: Snapdragon 710 Mobile Platform
status: affected, version: Snapdragon 720G Mobile Platform
status: affected, version: Snapdragon 730 Mobile Platform (SM7150-AA)
status: affected, version: Snapdragon 730G Mobile Platform (SM7150-AB)
status: affected, version: Snapdragon 732G Mobile Platform (SM7150-AC)
status: affected, version: Snapdragon 750G 5G Mobile Platform
status: affected, version: Snapdragon 765 5G Mobile Platform (SM7250-AA)
status: affected, version: Snapdragon 765G 5G Mobile Platform (SM7250-AB)
status: affected, version: Snapdragon 768G 5G Mobile Platform (SM7250-AC)
status: affected, version: Snapdragon 778G 5G Mobile Platform
status: affected, version: Snapdragon 778G+ 5G Mobile Platform (SM7325-AE)
status: affected, version: Snapdragon 780G 5G Mobile Platform
status: affected, version: Snapdragon 782G Mobile Platform (SM7325-AF)
status: affected, version: Snapdragon 7c+ Gen 3 Compute
status: affected, version: Snapdragon 8 Gen 1 Mobile Platform
status: affected, version: Snapdragon 8 Gen 2 Mobile Platform
status: affected, version: Snapdragon 8+ Gen 1 Mobile Platform
status: affected, version: Snapdragon 8+ Gen 2 Mobile Platform
status: affected, version: Snapdragon 845 Mobile Platform
status: affected, version: Snapdragon 855 Mobile Platform
status: affected, version: Snapdragon 855+/860 Mobile Platform (SM8150-AC)
status: affected, version: Snapdragon 865 5G Mobile Platform
status: affected, version: Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
status: affected, version: Snapdragon 870 5G Mobile Platform (SM8250-AC)
status: affected, version: Snapdragon 888 5G Mobile Platform
status: affected, version: Snapdragon 888+ 5G Mobile Platform (SM8350-AC)
status: affected, version: Snapdragon AR2 Gen 1 Platform
status: affected, version: Snapdragon Auto 5G Modem-RF
status: affected, version: Snapdragon Auto 5G Modem-RF Gen 2
status: affected, version: Snapdragon W5+ Gen 1 Wearable Platform
status: affected, version: Snapdragon Wear 4100+ Platform
status: affected, version: Snapdragon X12 LTE Modem
status: affected, version: Snapdragon X35 5G Modem-RF System
status: affected, version: Snapdragon X50 5G Modem-RF System
status: affected, version: Snapdragon X55 5G Modem-RF System
status: affected, version: Snapdragon X65 5G Modem-RF System
status: affected, version: Snapdragon X75 5G Modem-RF System
status: affected, version: Snapdragon XR1 Platform
status: affected, version: Snapdragon XR2 5G Platform
status: affected, version: Snapdragon XR2+ Gen 1 Platform
status: affected, version: Snapdragon Auto 4G Modem
status: affected, version: SRV1H
status: affected, version: SRV1M
status: affected, version: SSG2115P
status: affected, version: SSG2125P
status: affected, version: SW5100
status: affected, version: SW5100P
status: affected, version: SXR1120
status: affected, version: SXR1230P
status: affected, version: SXR2130
status: affected, version: SXR2230P
status: affected, version: Vision Intelligence 100 Platform (APQ8053-AA)
status: affected, version: Vision Intelligence 200 Platform (APQ8053-AC)
status: affected, version: Vision Intelligence 400 Platform
status: affected, version: WCD9326
status: affected, version: WCD9335
status: affected, version: WCD9340
status: affected, version: WCD9341
status: affected, version: WCD9360
status: affected, version: WCD9370
status: affected, version: WCD9375
status: affected, version: WCD9380
status: affected, version: WCD9385
status: affected, version: WCD9390
status: affected, version: WCD9395
status: affected, version: WCN3610
status: affected, version: WCN3615
status: affected, version: WCN3620
status: affected, version: WCN3660B
status: affected, version: WCN3680
status: affected, version: WCN3680B
status: affected, version: WCN3910
status: affected, version: WCN3950
status: affected, version: WCN3980
status: affected, version: WCN3988
status: affected, version: WCN3990
status: affected, version: WCN6740
status: affected, version: WSA8810
status: affected, version: WSA8815
status: affected, version: WSA8830
status: affected, version: WSA8832
status: affected, version: WSA8835
status: affected, version: WSA8840
status: affected, version: WSA8845
status: affected, version: WSA8845H
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL