CVE-2020-11281
📋 TL;DR
This vulnerability in Qualcomm Snapdragon chipsets allows attackers to link RTT (Round Trip Time) frames by comparing sequence numbers when non-randomized MAC addresses are used, potentially exposing location tracking information. It affects numerous Snapdragon product lines including Auto, Compute, Mobile, and IoT devices. The information disclosure could reveal device proximity and movement patterns.
💻 Affected Systems
- Snapdragon Auto
- Snapdragon Compute
- Snapdragon Connectivity
- Snapdragon Consumer Electronics Connectivity
- Snapdragon Consumer IOT
- Snapdragon Industrial IOT
- Snapdragon Mobile
- Snapdragon Voice & Music
- Snapdragon Wired Infrastructure and Networking
📦 What is this software?
Sd7c Firmware by Qualcomm
Sd8c Firmware by Qualcomm
⚠️ Risk & Real-World Impact
Worst Case
Persistent tracking of device location and movement patterns, enabling physical surveillance or targeted attacks based on location data.
Likely Case
Intermittent location data leakage allowing approximate tracking of device movements in affected areas.
If Mitigated
Minimal impact with proper MAC address randomization and network segmentation in place.
🎯 Exploit Status
Exploitation requires specialized wireless equipment and proximity to target device; no public exploits known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Qualcomm February 2021 security bulletin for specific chipset/firmware versions
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates. 2. Apply Qualcomm-provided patches through OEM updates. 3. Reboot device after update installation.
🔧 Temporary Workarounds
Enable MAC Address Randomization
androidForce devices to use randomized MAC addresses for wireless connections
Android: Settings > Network & Internet > Wi-Fi > Advanced > Privacy > Use randomized MAC
Disable RTT/Wi-Fi Round Trip Time
androidTurn off RTT capabilities if not required for functionality
Android: Settings > Location > Wi-Fi scanning > Disable
🧯 If You Can't Patch
- Segment wireless networks to limit exposure of vulnerable devices
- Implement physical security controls to prevent unauthorized proximity to critical devices
🔍 How to Verify
Check if Vulnerable:
Check device chipset model and firmware version against Qualcomm's advisory; devices with affected Snapdragon chipsets running unpatched firmware are vulnerable.Check Version:
Android: Settings > About Phone > Android Version / Build NumberVerify Fix Applied:
Verify firmware version has been updated to post-February 2021 patches from device manufacturer.📡 Detection & Monitoring
Log Indicators:
- Unusual RTT frame patterns
- Multiple association attempts with non-randomized MACs
Network Indicators:
- Suspicious wireless probing near sensitive devices
- Abnormal RTT measurement traffic
SIEM Query:
wireless AND (rtt OR "round trip") AND mac_address NOT randomized