Details of VAR-201911-1654

ID

VAR-201911-1654

CVE

CVE-2019-10565

TITLE

plural Snapdragon Double release vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-011668

DESCRIPTION

Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, QCN7605, QCS405, QCS605, SDM845, SDX24, SXR1130. plural Snapdragon The product contains a double release vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows local attackers to escalate privileges on affected installations of Google Android. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the v4l2 driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this to escalate privileges in the context of the kernel. Android is a set of Linux-based open source operating systems from Google (United States) and the Open Handset Alliance (OHA). Video4Linux2 (V4L2) is one of the kernel drivers used for video devices in Linux

Trust: 2.79

sources: NVD: CVE-2019-10565 // JVNDB: JVNDB-2019-011668 // ZDI: ZDI-19-780 // CNNVD: CNNVD-201909-246

IOT TAXONOMY

category:	['other device', 'embedded device']	sub_category:	SoC	Trust: 0.1
category:	['other device', 'embedded device']	sub_category:	general	Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	qualcomm	model:	msm8909	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8053	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9206	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcn7605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx24	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8909w	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9207c	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8905	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs405	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr1130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8053	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9206	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9207c	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9607	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8905	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8909	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8909w	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcn7605	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcs405	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcs605	scope:	-	version:	-	Trust: 0.8
vendor:	google	model:	android	scope:	-	version:	-	Trust: 0.7

sources: ZDI: ZDI-19-780 // JVNDB: JVNDB-2019-011668 // NVD: CVE-2019-10565

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-10565
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-10565
value:	CRITICAL
Trust: 0.8
ZDI:	CVE-2019-10565
value:	HIGH
Trust: 0.7
CNNVD:	CNNVD-201911-328
value:	CRITICAL
Trust: 0.6
CNNVD:	CNNVD-201909-246
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-10565
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2019-10565
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-10565
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2019-10565
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.1
impactScore:	6.0
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-19-780 // JVNDB: JVNDB-2019-011668 // CNNVD: CNNVD-201911-328 // CNNVD: CNNVD-201909-246 // NVD: CVE-2019-10565

PROBLEMTYPE DATA

problemtype:

CWE-415

Trust: 1.8

sources: JVNDB: JVNDB-2019-011668 // NVD: CVE-2019-10565

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-328

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201911-328

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-011668

PATCH

title:	Android のセキュリティに関する公開情報	url:	https://source.android.com/security/bulletin/	Trust: 0.8
title:	Multiple Qualcomm Product resource management error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=102094	Trust: 0.6

sources: JVNDB: JVNDB-2019-011668 // CNNVD: CNNVD-201911-328

EXTERNAL IDS

db:	NVD	id:	CVE-2019-10565	Trust: 3.2
db:	ZDI	id:	ZDI-19-780	Trust: 1.3
db:	JVNDB	id:	JVNDB-2019-011668	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-8316	Trust: 0.7
db:	CNNVD	id:	CNNVD-201911-328	Trust: 0.6
db:	CNNVD	id:	CNNVD-201909-246	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // ZDI: ZDI-19-780 // JVNDB: JVNDB-2019-011668 // CNNVD: CNNVD-201911-328 // CNNVD: CNNVD-201909-246 // NVD: CVE-2019-10565

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10565	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10565	Trust: 0.8
url:	https://source.android.com/security/bulletin/	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-19-780/	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2019-011668 // CNNVD: CNNVD-201911-328 // CNNVD: CNNVD-201909-246 // NVD: CVE-2019-10565

CREDITS

Lance Jiang and Moony Li of TrendMicro Research

Trust: 1.3

sources: ZDI: ZDI-19-780 // CNNVD: CNNVD-201909-246

SOURCES

db:	OTHER	id:	-
db:	ZDI	id:	ZDI-19-780
db:	JVNDB	id:	JVNDB-2019-011668
db:	CNNVD	id:	CNNVD-201911-328
db:	CNNVD	id:	CNNVD-201909-246
db:	NVD	id:	CVE-2019-10565

LAST UPDATE DATE

2025-01-30T22:29:41.114000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-19-780	date:	2020-03-13T00:00:00
db:	JVNDB	id:	JVNDB-2019-011668	date:	2019-11-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-328	date:	2020-06-24T00:00:00
db:	CNNVD	id:	CNNVD-201909-246	date:	2019-09-06T00:00:00
db:	NVD	id:	CVE-2019-10565	date:	2024-11-21T04:19:28.053

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-19-780	date:	2019-09-04T00:00:00
db:	JVNDB	id:	JVNDB-2019-011668	date:	2019-11-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-328	date:	2019-11-06T00:00:00
db:	CNNVD	id:	CNNVD-201909-246	date:	2019-09-04T00:00:00
db:	NVD	id:	CVE-2019-10565	date:	2019-11-06T17:15:12.970