CVE-2020-11184
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Qualcomm Snapdragon devices by exploiting a buffer overflow in the video parser when processing specially crafted MP4 files. It affects multiple Snapdragon platforms across automotive, compute, industrial IoT, and mobile sectors. With a CVSS score of 9.8, this is a critical vulnerability that could lead to complete system compromise.
💻 Affected Systems
- QCM4290
- QCS4290
- QM215
- QSM8350
- SA6145P
- SA6155
- SA6155P
- SA8155
- SA8155P
- SDX55
- SDX55M
- SM4250
- SM4250P
- SM6115
- SM6115P
- SM6125
- SM6250
- SM6350
- SM7125
- SM7225
- SM7250
- SM7250P
- SM8150
- SM8150P
- SM8250
- SM8350
- SM8350P
- SXR2130
- SXR2130P
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full device compromise, data theft, persistent backdoor installation, and potential lateral movement within networks.
Likely Case
Application crash (denial of service) or limited code execution within the video processing context, potentially escalating to full system compromise.
If Mitigated
Application crash without code execution if memory protections like ASLR/DEP are effective, but still results in service disruption.
🎯 Exploit Status
Exploitation requires crafting a malicious MP4 file with specific esds atom size manipulation. No public exploit code was available at disclosure time, but the vulnerability is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released by device manufacturers in late 2020/early 2021
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
Restart Required: Yes
Instructions:
1. Check with device manufacturer for firmware updates. 2. Apply the latest firmware/security patch. 3. Reboot device. 4. Verify patch installation through system settings.
🔧 Temporary Workarounds
Disable automatic media processing
allPrevent automatic parsing of MP4 files by applications
Use application sandboxing
allRun media players in restricted environments with limited permissions
🧯 If You Can't Patch
- Isolate affected devices from untrusted networks and internet access
- Implement strict file upload filtering to block MP4 files from untrusted sources
- Use network segmentation to limit potential lateral movement
- Monitor for abnormal media processing behavior or crashes
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against manufacturer's security bulletins. Look for 'November 2020' or later security patches in Android security patch level.Check Version:
On Android: adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level is November 2020 or later in Settings > About phone > Android security patch level. Confirm with device manufacturer that specific firmware includes CVE-2020-11184 fix.📡 Detection & Monitoring
Log Indicators:
- Video processing service crashes
- Media player application failures
- Kernel panic logs related to video drivers
- Memory corruption errors in system logs
Network Indicators:
- Unusual MP4 file transfers to devices
- Multiple failed media processing attempts
- Traffic patterns suggesting file delivery for exploitation
SIEM Query:
source="*kernel*" AND ("video" OR "mp4" OR "esds") AND ("crash" OR "panic" OR "buffer overflow")