July 2019 Code Aurora Security Bulletin

Version 1.0

This document describes security vulnerabilities that were addressed through software changes. Source code patches for these issues have been released to the Code Aurora Forum (CAF) and linked from this bulletin. These changes are applicable but not limited to Android for MSM (all Android releases from CAF using the Linux-kernel), Firefox OS for MSM & QRD Android projects. Customers were previously notified of the issues described in this bulletin. Each of the vulnerabilities has an associated security rating. A description of these ratings using v 1.2 of the ratings scheme can be found at the following link.

Please reach out to security-advisory@quicinc.com for any questions related to this bulletin.

Announcements

None.

Acknowledgements

We would like to thank these researchers for their contributions in reporting these issues to us.

CVE-2018-13897	CERT
CVE-2019-2272	heidada (heiheidada)
CVE-2019-2276	C0RE Team (c0reteam)
CVE-2019-2301, CVE-2019-2305, CVE-2019-2306	Reported to us through Google Android Security team; please see bulletins at https://source.android.com/security/overview/acknowledgements/ for individual credit information. For issues rated medium or lower, the individual credit information may appear in a future Android major release bulletin.
CVE-2019-2309	%i%s%n\nAAA (derrek)
CVE-2019-2312	Gengjia Chen (chengjia4574)
CVE-2019-2314	Gengjia Chen ( @chengjia4574 ) of IceSword Lab, Qihoo 360 Technology Co. Ltd.
CVE-2019-2326	Peter Pi of Tencent

Table of vulnerabilities

Public ID	Security Rating	Technology Area	Date Reported
CVE-2018-13897	High	Data Network Stack & Connectivity	7/18/2018
CVE-2019-2263	Medium	Core Services	Internal
CVE-2019-2272	Medium	Multimedia	9/20/2018
CVE-2019-2276	High	WLAN HOST	10/19/2018
CVE-2019-2278	High	HLOS	11/1/2018
CVE-2019-2290	Medium	Multimedia	Internal
CVE-2019-2293	Medium	Camera Driver	Internal
CVE-2019-2299	Medium	WLAN HOST	Internal
CVE-2019-2301	Medium	Qualcomm IPC	6/19/2018
CVE-2019-2305	High	WLAN HOST	5/4/2018
CVE-2019-2306	Medium	Display	10/10/2018
CVE-2019-2307	High	WLAN HOST	Internal
CVE-2019-2308	Critical	DSP Service	Internal
CVE-2019-2309	Medium	WLAN HOST	2/14/2018
CVE-2019-2312	Medium	WLAN HOST	10/30/2018
CVE-2019-2314	Medium	Display	11/15/2018
CVE-2019-2316	High	HLOS	Internal
CVE-2019-2326	High	Audio	12/4/2018
CVE-2019-2328	High	Audio	Internal
CVE-2019-2330	Critical	Kernel	Internal
CVE-2019-2345	Medium	Camera_Linux	Internal

CVE-2018-13897

CVE ID	CVE-2018-13897
Title	Information Exposure in HLOS Data
Description	Client’s hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure
Technology Area	Data Network Stack & Connectivity
Vulnerability Type	CWE-200 Information Exposure
Access Vector	Remote
Security Rating	High
Date Reported	7/18/2018
Customer Notified Date	10/1/2018
Affected Chipsets	MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660
Patch	https://source.codeaurora.org/quic/la/platform/system/netd/commit?id=a0787febf7effc480dfc4d0cbc548ea90d3f74ab

CVE-2019-2263

CVE ID	CVE-2019-2263
Title	Use After Free While Reading from Diag Driver
Description	Access to freed memory can happen while reading from diag driver due to use after free issue
Technology Area	Core Services
Vulnerability Type	CWE-416 Use After Free
Access Vector	Local
Security Rating	Medium
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA9531, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDM660, SDX20, Snapdragon_High_Med_2016
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=fad1f47e52a5ca16b1f0a22cbae121ef87aa8e2e

CVE-2019-2272

CVE ID	CVE-2019-2272
Title	Buffer Copy Without Checking Size of Input in Display
Description	Buffer overflow can occur in display function due to lack of validation of header block size set by user.
Technology Area	Multimedia
Vulnerability Type	CWE-120 Buffer Copy Without Checking Size of Input (‘Classic Buffer Overflow’)
Access Vector	Local
Security Rating	Medium
Date Reported	9/20/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SDM660, SDX20
Patch	https://source.codeaurora.org/quic/le/kernel/lk/commit/?id=7c6408cf1de6caccababbab774cd7aca9016a501

CVE-2019-2276

CVE ID	CVE-2019-2276
Title	Buffer Over-read in WLAN
Description	Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received from user controlled space
Technology Area	WLAN HOST
Vulnerability Type	CWE-126 Buffer Over-read
Access Vector	Remote
Security Rating	High
Date Reported	10/19/2018
Customer Notified Date	3/4/2019
Affected Chipsets	MDM9607, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
Patch	https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=f563b1c638f678f2e0bc5820643fb35006a39648

CVE-2019-2278

CVE ID	CVE-2019-2278
Title	Improper Authentication in Boot
Description	User keystore signature is ignored in boot and can lead to bypass boot image signature verification
Technology Area	HLOS
Vulnerability Type	CWE-287 Improper Authentication
Access Vector	Local
Security Rating	High
Date Reported	11/1/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660
Patch	https://source.codeaurora.org/quic/le/kernel/lk/commit/?id=8ac15b064823c01aafc4264b9b4c7b0b16d057a6

CVE-2019-2290

CVE ID	CVE-2019-2290
Title	Use After Free Issue in Camera
Description	Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer
Technology Area	Multimedia
Vulnerability Type	CWE-416 Use After Free
Access Vector	Local
Security Rating	Medium
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDM660, SDX20, SDX24, Snapdragon_High_Med_2016
Patch	https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=3b1375201314018b4e911e60f89ca48a0d722503 https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=062e9f67de7f2633dca6f93a40c1d0497a3ee418 https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=bcc46239ac9aaeb2a57b5573e348b7a789215eb2

CVE-2019-2293

CVE ID	CVE-2019-2293
Title	Use After Free in Camera
Description	Pointer dereference while freeing IFE resources due to lack of length check of in port resource.
Technology Area	Camera Driver
Vulnerability Type	CWE-416 Use After Free
Access Vector	Local
Security Rating	Medium
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MSM8909W, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=b24dae2dbb2bdfbb7d6e489fecbc02a3d9e6faf9

CVE-2019-2299

CVE ID	CVE-2019-2299
Title	Integer Overflow to Buffer Overflow in WLAN
Description	An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application.
Technology Area	WLAN HOST
Vulnerability Type	CWE-680 Integer Overflow to Buffer Overflow
Access Vector	Local
Security Rating	Medium
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/qsdk/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn/commit/?id=763f5b64eca4e487014931d4187fcdd148c1ca4b https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=369284f71db1065cae647c0bbe4133e23b9cef4a

CVE-2019-2301

CVE ID	CVE-2019-2301
Title	Buffer Copy Without Checking Size of Input in Kernel
Description	Possibility of out-of-bound read if id received from SPI is not in range of FIFO
Technology Area	Qualcomm IPC
Vulnerability Type	CWE-120 Buffer Copy Without Checking Size of Input (‘Classic Buffer Overflow’)
Access Vector	Local
Security Rating	Medium
Date Reported	6/19/2018
Customer Notified Date	4/1/2019
Affected Chipsets	IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9980, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=1d182aebf4045c8f7156f8605e9defbd5e7c26cf

CVE-2019-2305

CVE ID	CVE-2019-2305
Title	Buffer Over-read Issue in WLAN
Description	Out of bound access when reason code is extracted from frame data without validating the frame length
Technology Area	WLAN HOST
Vulnerability Type	CWE-126 Buffer Over-read
Access Vector	Remote
Security Rating	High
Date Reported	5/4/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=1fb81bf82d50a236e963a66eee1aa3310c8d4666 https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=5f096fc4e85abca475fe61af2ee7370b32d01751

CVE-2019-2306

CVE ID	CVE-2019-2306
Title	Buffer Over-read Issue in Display
Description	Improper casting of structure while handling the buffer leads to out of bound read in display
Technology Area	Display
Vulnerability Type	CWE-126 Buffer Over-read
Access Vector	Local
Security Rating	Medium
Date Reported	10/10/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
Patch	https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=993261eb29127b942c5eb81de168cb2f39bfcd2e https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=d91a525dba4b3e7cdbbedf62e15aeaef90c8eb32 https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/display-commonsys-intf/commit/?id=568949a84bb5db94f76dd878c80bd97efa16bffe https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=b9117af61990a711fd772838ecbaafc2b61a242a https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=2f552838d62c9c1615a596db635711cc7b8678cb https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=56faddf5d17d4deee0b061ee42e1c8b3376d6d49 https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=2afb53236c2c022978eeb0815ae9621c2766fd22 https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=6f12008b77536b2aee0bfd1019269dd9b134716a https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=ec86fea4a518b52d6172507313ce294b3cbb0b93

CVE-2019-2307

CVE ID	CVE-2019-2307
Title	Integer Underflow Issue in WLAN
Description	Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration
Technology Area	WLAN HOST
Vulnerability Type	CWE-126 Buffer Over-read
Access Vector	Remote
Security Rating	High
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=99e80b2a85b9ddf3d8ee0be530f7e7a78598eb01 https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=de8328b525884de4437f380cf05343a5f4455ac6

CVE-2019-2308

CVE ID	CVE-2019-2308
Title	Permissions, Privileges and Access Control Issue in DSP Services
Description	User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subsystem
Technology Area	DSP Service
Vulnerability Type	CWE-264 Permissions, Privileges, and Access Controls
Access Vector	Local
Security Rating	Critical
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=cc2e11eeb988964af72309f71b0fb21c11ed6ca9

CVE-2019-2309

CVE ID	CVE-2019-2309
Title	Buffer Over-read Issue in WLAN
Description	While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length.
Technology Area	WLAN HOST
Vulnerability Type	CWE-126 Buffer Over-read
Access Vector	Local
Security Rating	Medium
Date Reported	2/14/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SDM660, SDX20
Patch	https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=5a677f362bd9bc99c371a908cad79aab686a40e9

CVE-2019-2312

CVE ID	CVE-2019-2312
Title	Buffer Copy Without Checking Size of Input in WLAN
Description	When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received
Technology Area	WLAN HOST
Vulnerability Type	CWE-120 Buffer Copy Without Checking Size of Input (‘Classic Buffer Overflow’)
Access Vector	Local
Security Rating	Medium
Date Reported	10/30/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9607, MDM9640, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
Patch	https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=9f1a091072339a33382c36a0e55df75a9621d1c3

CVE-2019-2314

CVE ID	CVE-2019-2314
Title	Use After Free Issue in Display
Description	Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time
Technology Area	Display
Vulnerability Type	CWE-416 Use After Free
Access Vector	Local
Security Rating	Medium
Date Reported	11/15/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MSM8909W, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=95bfa6cf89482c795e54ce4ee026ef068c9495c7

CVE-2019-2316

CVE ID	CVE-2019-2316
Title	Use After Free Issue in HLOS
Description	When computing the digest a local variable is used after going out of scope
Technology Area	HLOS
Vulnerability Type	CWE-416 Use After Free
Access Vector	Local
Security Rating	High
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM660, SDX24
Patch	https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=28cde30b1b0309efaab9779c7eec3104dfe8ad28

CVE-2019-2326

CVE ID	CVE-2019-2326
Title	Improper Validation of Array Index in Audio Driver
Description	Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access
Technology Area	Audio
Vulnerability Type	CWE-129 Improper Validation of Array Index
Access Vector	Local
Security Rating	High
Date Reported	12/4/2018
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/platform/vendor/opensource/audio-kernel/commit/?id=c0d32d41dbc9f2c4910ba757ccbc2d9454e8d796 https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=8f477c1614c367cabd8d37ec0bd309db287f1435

CVE-2019-2328

CVE ID	CVE-2019-2328
Title	Buffer Copy Without Checking Size of Input in Audio Driver
Description	Possible buffer overflow when number of channels passed is more than size of channel mapping array
Technology Area	Audio
Vulnerability Type	CWE-120 Buffer Copy Without Checking Size of Input (‘Classic Buffer Overflow’)
Access Vector	Local
Security Rating	High
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=f9559ef56f459081a03d057304a1d9bb72d0f629 https://source.codeaurora.org/quic/la/platform/vendor/opensource/audio-kernel/commit/?id=258efb21152abb8c8dcfc04604b121665c147ff0

CVE-2019-2330

CVE ID	CVE-2019-2330
Title	Improper Input Validation in Kernel
Description	improper input validation in allocation request for secure allocations can lead to page fault.
Technology Area	Kernel
Vulnerability Type	CWE-20 Improper Input Validation
Access Vector	Local
Security Rating	Critical
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=979cdd6f6e26da14aa95e2e7e116f9af72b122dc

CVE-2019-2345

CVE ID	CVE-2019-2345
Title	Always-incorrect Control Flow Implementation in Camera Library
Description	Race condition while accessing DMA buffer in jpeg driver
Technology Area	Camera_Linux
Vulnerability Type	CWE-670 Always-Incorrect Control Flow Implementation
Access Vector	Local
Security Rating	Medium
Date Reported	Internal
Customer Notified Date	4/1/2019
Affected Chipsets	MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM660, SDX20, SDX24
Patch	https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=8fe29c70d28c6f5a2adcdf24987cc6d431372d8f

Industry Coordination

Security ratings of issues included in Android security bulletins and these bulletins match in the most common scenarios but may differ in some cases due to one of the following reasons:

Consideration of security protections such as SELinux not enforced on some platforms
Differences in assessment of some specific scenarios that involves local denial of service or privilege escalation vulnerabilities in the high level OS kernel

Version History

Version	Date	Comments
1.0	July 1, 2019	Bulletin Published