Details of VAR-202006-1565

ID

VAR-202006-1565

CVE

CVE-2020-3642

TITLE

plural Snapdragon Product free memory usage vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-006983

DESCRIPTION

Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snapdragon Consumer IOT, Snapdragon Mobile in Kamorta, QCS605, Rennell, Saipan, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130. plural Snapdragon The product contains a vulnerability related to the use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state

Trust: 1.62

sources: NVD: CVE-2020-3642 // JVNDB: JVNDB-2020-006983

IOT TAXONOMY

category:	['other device', 'embedded device']	sub_category:	SoC	Trust: 0.1
category:	['other device', 'embedded device']	sub_category:	general	Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	qualcomm	model:	sm8150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	saipan	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm7150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm6150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	kamorta	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr1130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	rennell	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr2130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm8250	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm670	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm710	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	kamorta	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcs605	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	rennell	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	saipan	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sdm 670	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sdm 710	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sdm845	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sm 6150	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sm 7150	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sm8150	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-006983 // NVD: CVE-2020-3642

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-3642
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-006983
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202006-080
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-3642
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-006983
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

nvd@nist.gov:	CVE-2020-3642
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-006983
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-006983 // CNNVD: CNNVD-202006-080 // NVD: CVE-2020-3642

PROBLEMTYPE DATA

problemtype:

CWE-416

Trust: 1.8

sources: JVNDB: JVNDB-2020-006983 // NVD: CVE-2020-3642

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202006-080

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202006-080

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-006983

PATCH

title:

June 2020 Security Bulletin

url:

https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin

Trust: 0.8

sources: JVNDB: JVNDB-2020-006983

EXTERNAL IDS

db:	NVD	id:	CVE-2020-3642	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-006983	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.1910	Trust: 0.6
db:	CNNVD	id:	CNNVD-202006-080	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2020-006983 // CNNVD: CNNVD-202006-080 // NVD: CVE-2020-3642

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin	Trust: 1.6
url:	https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-3642	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3642	Trust: 0.8
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-june-2020-32386	Trust: 0.6
url:	https://source.android.com/security/bulletin/2020-06-01	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.1910/	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2020-006983 // CNNVD: CNNVD-202006-080 // NVD: CVE-2020-3642

SOURCES

db:	OTHER	id:	-
db:	JVNDB	id:	JVNDB-2020-006983
db:	CNNVD	id:	CNNVD-202006-080
db:	NVD	id:	CVE-2020-3642

LAST UPDATE DATE

2025-01-30T22:27:33.951000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-006983	date:	2020-07-28T00:00:00
db:	CNNVD	id:	CNNVD-202006-080	date:	2020-06-30T00:00:00
db:	NVD	id:	CVE-2020-3642	date:	2024-11-21T05:31:28.143

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-006983	date:	2020-07-28T00:00:00
db:	CNNVD	id:	CNNVD-202006-080	date:	2020-06-01T00:00:00
db:	NVD	id:	CVE-2020-3642	date:	2020-06-22T07:15:12.117