CVE-2020-11146

Q: What is the severity of CVE-2020-11146?

CVE-2020-11146 has a CVSS score of 7.8 (HIGH). This vulnerability allows attackers to write data beyond allocated memory bounds in Qualcomm Snapdragon chipsets via IOCTL calls, potentially leading to arbitrary code execution. It affects multiple Snapdragon product lines including Auto, Compute, Mobile, and Wearables. Attackers need local access to exploit this flaw.

7.8 HIGH

📋 TL;DR

This vulnerability allows attackers to write data beyond allocated memory bounds in Qualcomm Snapdragon chipsets via IOCTL calls, potentially leading to arbitrary code execution. It affects multiple Snapdragon product lines including Auto, Compute, Mobile, and Wearables. Attackers need local access to exploit this flaw.

💻 Affected Systems

Products:

Snapdragon Auto
Snapdragon Compute
Snapdragon Connectivity
Snapdragon Consumer IOT
Snapdragon Industrial IOT
Snapdragon Mobile
Snapdragon Voice & Music
Snapdragon Wearables

Versions: Multiple chipset versions across these product lines

Operating Systems: Android-based systems and other embedded OS using affected Snapdragon chipsets

Default Config Vulnerable: ⚠️ Yes

Notes: Specific chipset models and firmware versions vary; check Qualcomm advisory for exact affected components.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with kernel-level privileges, allowing complete control over affected device including data theft, persistence, and further network propagation.

🟠

Likely Case

Local privilege escalation from user to kernel mode, enabling installation of malware, data access, and system manipulation.

🟢

If Mitigated

Limited impact with proper access controls and isolation, potentially only denial of service or system instability.

🌐 Internet-Facing: LOW - Requires local access to device, not directly exploitable over network.

🏢 Internal Only: HIGH - Local attackers or malware with user access can exploit to gain kernel privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to make IOCTL calls; kernel exploitation knowledge needed for reliable exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by device manufacturer and chipset - check device vendor updates

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Restart Required: Yes

Instructions:

1. Check with device manufacturer for firmware updates. 2. Apply latest security patches from device vendor. 3. Reboot device after update. 4. Verify patch installation.

🔧 Temporary Workarounds

Restrict IOCTL access

linux

Limit access to vulnerable IOCTL interfaces through SELinux/AppArmor policies

# Requires custom SELinux/AppArmor policy configuration
# Consult device manufacturer for specific implementation

🧯 If You Can't Patch

Implement strict application sandboxing and privilege separation
Monitor for unusual kernel module loading or privilege escalation attempts

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against manufacturer's patched versions; use 'getprop ro.build.fingerprint' on Android devices

Check Version:

adb shell getprop ro.build.fingerprint (for Android devices)

Verify Fix Applied:

Verify firmware version matches or exceeds patched version from manufacturer advisory

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
Unexpected IOCTL calls from user processes
Privilege escalation attempts in audit logs

Network Indicators:

Not applicable - local exploitation only

SIEM Query:

source="kernel" AND ("panic" OR "oops") OR source="audit" AND "ioctl" AND "denied"

📊 Metadata

CVE ID: CVE-2020-11146

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-129

Published: January 21, 2021

Last Updated: November 21, 2024

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin Patch,Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin Broken Link

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Apq8076 by Qualcomm

Aqt1000 by Qualcomm

Ar8031 by Qualcomm

Ar8035 by Qualcomm

Csra6620 by Qualcomm

Csra6640 by Qualcomm

Msm8937 by Qualcomm

Pm215 by Qualcomm

Pm3003a by Qualcomm

Pm4125 by Qualcomm

Pm456 by Qualcomm

Pm6125 by Qualcomm

Pm6150 by Qualcomm

Pm6150a by Qualcomm

Pm6150l by Qualcomm

Pm6250 by Qualcomm

Pm6350 by Qualcomm

Pm640a by Qualcomm

Pm640l by Qualcomm

Pm640p by Qualcomm

Pm660 by Qualcomm

Pm660l by Qualcomm

Pm670 by Qualcomm

Pm670l by Qualcomm

Pm7150a by Qualcomm

Pm7150l by Qualcomm

Pm7250 by Qualcomm

Pm7250b by Qualcomm

Pm7350c by Qualcomm

Pm8004 by Qualcomm

Pm8005 by Qualcomm

Pm8008 by Qualcomm

Pm8009 by Qualcomm

Pm8150 by Qualcomm

Pm8150a by Qualcomm

Pm8150b by Qualcomm

Pm8150c by Qualcomm

Pm8150l by Qualcomm

Pm8250 by Qualcomm

Pm8350 by Qualcomm

Pm8350b by Qualcomm

Pm8350bh by Qualcomm

Pm8350bhs by Qualcomm

Pm8350c by Qualcomm

Pm855 by Qualcomm

Pm855b by Qualcomm

Pm855l by Qualcomm

Pm855p by Qualcomm

Pm8909 by Qualcomm

Pm8916 by Qualcomm

Pm8937 by Qualcomm

Pm8952 by Qualcomm

Pm8956 by Qualcomm

Pm8998 by Qualcomm

Pmc1000h by Qualcomm

Pmd9655 by Qualcomm

Pmi632 by Qualcomm

Pmi8937 by Qualcomm

Pmi8952 by Qualcomm

Pmi8998 by Qualcomm

Pmk7350 by Qualcomm

Pmk8002 by Qualcomm

Pmk8003 by Qualcomm

Pmk8350 by Qualcomm

Pmm6155au by Qualcomm

Pmm8155au by Qualcomm

Pmm8195au by Qualcomm

Pmm855au by Qualcomm

Pmr525 by Qualcomm

Pmr735a by Qualcomm

Pmr735b by Qualcomm

Pmw3100 by Qualcomm

Pmx55 by Qualcomm

Qat3514 by Qualcomm

Qat3516 by Qualcomm

Qat3518 by Qualcomm

Qat3519 by Qualcomm