CVE-2020-11167

Q: What is the severity of CVE-2020-11167?

CVE-2020-11167 has a CVSS score of 9.8 (CRITICAL). This is a critical memory corruption vulnerability in Qualcomm Snapdragon chipsets' Bluetooth L2CAP reassembly logic. Attackers can remotely execute arbitrary code or cause denial of service by sending specially crafted Bluetooth packets that exceed expected data lengths. Affects numerous Qualcomm Snapdragon platforms across automotive, mobile, IoT, and wearable devices.

9.8 CRITICAL

Remote Code Execution Denial of Service

📋 TL;DR

This is a critical memory corruption vulnerability in Qualcomm Snapdragon chipsets' Bluetooth L2CAP reassembly logic. Attackers can remotely execute arbitrary code or cause denial of service by sending specially crafted Bluetooth packets that exceed expected data lengths. Affects numerous Qualcomm Snapdragon platforms across automotive, mobile, IoT, and wearable devices.

💻 Affected Systems

Products:

Snapdragon Auto
Snapdragon Compute
Snapdragon Connectivity
Snapdragon Consumer IOT
Snapdragon Industrial IOT
Snapdragon Mobile
Snapdragon Voice & Music
Snapdragon Wearables

Versions: Multiple chipset versions - see Qualcomm December 2020 bulletin for specific affected chipsets

Operating Systems: Android, Linux-based embedded systems

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in Bluetooth firmware/stack. All devices with affected Snapdragon chipsets and Bluetooth enabled are vulnerable by default.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with kernel privileges leading to complete device compromise, data theft, and persistent backdoor installation.

🟠

Likely Case

Remote denial of service (device crash/reboot) or limited code execution in Bluetooth context.

🟢

If Mitigated

Denial of service only if exploit attempts are blocked or fail due to mitigations.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires Bluetooth proximity (typically within 10 meters). No authentication needed as Bluetooth pairing not required for this attack vector.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to device manufacturer updates - patches released in December 2020

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Restart Required: Yes

Instructions:

1. Check with device manufacturer for firmware/OS updates. 2. Apply latest security patches from device vendor. 3. Reboot device after update. 4. Verify Bluetooth stack version is patched.

🔧 Temporary Workarounds

Disable Bluetooth

all

Turn off Bluetooth when not in use to prevent remote exploitation

adb shell settings put global bluetooth_on 0
systemctl stop bluetooth (Linux)
Turn off in device settings

Restrict Bluetooth Visibility

all

Set Bluetooth to non-discoverable mode to reduce attack surface

adb shell settings put global bluetooth_discoverability 0
hciconfig hci0 noscan

🧯 If You Can't Patch

Segment affected devices on separate network/VLAN
Implement Bluetooth usage policies restricting to trusted devices only

🔍 How to Verify

Check if Vulnerable:

Check device chipset model and firmware version against Qualcomm advisory. Use: adb shell getprop ro.boot.hardware.sku or check device specifications.

Check Version:

adb shell getprop ro.build.version.security_patch

Verify Fix Applied:

Verify device has December 2020 or later security patches installed. Check Bluetooth stack version if available from manufacturer.

📡 Detection & Monitoring

Log Indicators:

Bluetooth stack crashes
Kernel panic logs
Unexpected Bluetooth disconnections

Network Indicators:

Unusual Bluetooth packet patterns
Multiple connection attempts from unknown devices

SIEM Query:

source="bluetooth" AND (event="crash" OR event="panic")

📊 Metadata

CVE ID: CVE-2020-11167

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-190

Published: January 21, 2021

Last Updated: November 21, 2024

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin Patch,Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin Broken Link

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Apq8009w by Qualcomm

Apq8017 by Qualcomm

Apq8037 by Qualcomm

Apq8053 by Qualcomm

Apq8064au by Qualcomm

Apq8096au by Qualcomm

Aqt1000 by Qualcomm

Msm8909w by Qualcomm

Msm8917 by Qualcomm

Msm8920 by Qualcomm

Msm8937 by Qualcomm

Msm8940 by Qualcomm

Msm8953 by Qualcomm

Msm8996au by Qualcomm

Pm215 by Qualcomm

Pm3003a by Qualcomm

Pm439 by Qualcomm

Pm6125 by Qualcomm

Pm6150 by Qualcomm

Pm6150a by Qualcomm

Pm6150l by Qualcomm

Pm6350 by Qualcomm

Pm640a by Qualcomm

Pm640l by Qualcomm

Pm640p by Qualcomm

Pm660 by Qualcomm

Pm660l by Qualcomm

Pm670 by Qualcomm

Pm670a by Qualcomm

Pm670l by Qualcomm

Pm7150a by Qualcomm

Pm7150l by Qualcomm

Pm7250 by Qualcomm

Pm7250b by Qualcomm

Pm8004 by Qualcomm

Pm8005 by Qualcomm

Pm8008 by Qualcomm

Pm8009 by Qualcomm

Pm8150a by Qualcomm

Pm8150b by Qualcomm

Pm8150c by Qualcomm

Pm8150l by Qualcomm

Pm8250 by Qualcomm

Pm855 by Qualcomm

Pm855a by Qualcomm

Pm855b by Qualcomm

Pm855l by Qualcomm

Pm855p by Qualcomm

Pm8909 by Qualcomm

Pm8937 by Qualcomm

Pm8940 by Qualcomm

Pm8953 by Qualcomm

Pm8996 by Qualcomm

Pm8998 by Qualcomm

Pmi632 by Qualcomm

Pmi8937 by Qualcomm

Pmi8952 by Qualcomm

Pmi8994 by Qualcomm

Pmi8996 by Qualcomm

Pmi8998 by Qualcomm

Pmk8001 by Qualcomm

Pmk8002 by Qualcomm

Pmk8003 by Qualcomm

Pmm855au by Qualcomm

Pmm8996au by Qualcomm

Pmr525 by Qualcomm

Pmr735a by Qualcomm

Pmr735b by Qualcomm

Pmw3100 by Qualcomm

Pmx50 by Qualcomm

Pmx55 by Qualcomm

Qat3516 by Qualcomm

Qat3518 by Qualcomm

Qat3519 by Qualcomm

Qat3522 by Qualcomm

Qat3550 by Qualcomm

Qat3555 by Qualcomm