CVE-2019-10603
📋 TL;DR
A use-after-free vulnerability in Qualcomm Snapdragon chipsets allows attackers to potentially execute arbitrary code or cause denial of service when sending raw IPv6 messages while the real device interface is down. This affects numerous Qualcomm-based devices across automotive, mobile, IoT, and wearable platforms. The vulnerability requires local access to the affected device.
💻 Affected Systems
- Snapdragon Auto
- Snapdragon Compute
- Snapdragon Consumer Electronics Connectivity
- Snapdragon Consumer IOT
- Snapdragon Industrial IOT
- Snapdragon Mobile
- Snapdragon Voice & Music
- Snapdragon Wearables
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution with kernel privileges, or persistent device compromise.
Likely Case
Denial of service (device crash/reboot) or limited information disclosure from kernel memory.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local access to affected systems.
🎯 Exploit Status
Exploitation requires local access and specific timing conditions (interface down during route lookup). No public exploits have been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Qualcomm security bulletin for specific chipset firmware updates
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates. 2. Apply Qualcomm-provided patches for affected chipsets. 3. Update device firmware through manufacturer channels. 4. Reboot device after patching.
🔧 Temporary Workarounds
Disable IPv6 raw sockets
linuxPrevent use of raw IPv6 sockets which trigger the vulnerable code path
echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
sysctl -w net.ipv6.conf.all.disable_ipv6=1
Restrict local access
allImplement strict access controls to prevent unauthorized local access to affected devices
🧯 If You Can't Patch
- Implement network segmentation to isolate affected devices from untrusted networks
- Deploy host-based security controls to detect and prevent privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check device chipset model and firmware version against Qualcomm's affected products listCheck Version:
cat /proc/cpuinfo | grep -i qualcomm && uname -aVerify Fix Applied:
Verify firmware version has been updated to a version after March 2020 security patches📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- System crash/reboot events
- IPv6 raw socket creation attempts
Network Indicators:
- Unusual IPv6 traffic patterns from affected devices
- Raw IPv6 socket usage
SIEM Query:
source="kernel" AND ("panic" OR "oops") AND device_chipset IN (affected_qualcomm_chipsets)