Vulnerability · Published Sep 8, 2020 · Assigned by qualcomm
CVE-2020-3702
Medium 6.5
In plain English
A medium-severity security flaw in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired In from Qualcomm, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.14.6-1 | DEBIAN-CVE-2020-3702 |
| Debian:13 | linux | 5.14.6-1 | DEBIAN-CVE-2020-3702 |
| Debian:14 | linux | 5.14.6-1 | DEBIAN-CVE-2020-3702 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-3702 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-3702 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-3702 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm, Inc. | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 |
References
- https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin x_refsource_CONFIRM
- https://www.arista.com/en/support/advisories-notices/security-advisories/11998-security-advisory-58 x_refsource_CONFIRM
- DSA-4978 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update mailing-list, x_refsource_MLIST