CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
Description
CVE-2020-11261 is a high-severity improper input validation vulnerability affecting multiple Qualcomm Snapdragon chipset product lines, including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables platforms. The flaw causes memory corruption when a user application requests an excessively large memory allocation and the system fails to properly validate the size parameter and return an error. CISA has added CVE-2020-11261 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 1.14% (78.3rd percentile), this vulnerability has a measurable probability of exploitation targeting mobile and IoT devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | apq8009 firmware | - |
| qualcomm | apq8009w firmware | - |
| qualcomm | apq8017 firmware | - |
| qualcomm | apq8037 firmware | - |
| qualcomm | apq8053 firmware | - |
| qualcomm | apq8064au firmware | - |
| qualcomm | apq8096au firmware | - |
| qualcomm | aqt1000 firmware | - |
| qualcomm | ar8031 firmware | - |
| qualcomm | ar8035 firmware | - |
| qualcomm | ar8151 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | csrb31024 firmware | - |
| qualcomm | fsm10055 firmware | - |
| qualcomm | fsm10056 firmware | - |
| qualcomm | mdm9650 firmware | - |
| qualcomm | msm8909w firmware | - |
| qualcomm | msm8917 firmware | - |
| qualcomm | msm8920 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11261(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In the context of Qualcomm Snapdragon chipsets, the out-of-bounds write occurs when improper memory allocation size validation leads to memory corruption. When an application requests an allocation of an excessively large size, the failure to properly handle this condition results in writes to memory locations outside the intended buffer boundaries, potentially allowing an attacker to corrupt adjacent memory structures and execute arbitrary code.
Learn more: CWE-787 — Out-of-bounds Write
CWE-20: Improper Input Validation
The root cause of this vulnerability is improper input validation in the Qualcomm graphics or display driver. The system does not properly check the size parameter when processing memory allocation requests from user-space applications, failing to return an error when the requested size exceeds safe limits. This allows a malicious application to trigger memory corruption through carefully crafted allocation requests.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2020-11261 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant local exploitation threat. The vulnerability requires local access and low-level privileges, but exploitation complexity is low and no user interaction is needed. Successful exploitation results in complete compromise of confidentiality, integrity, and availability on the affected device, as the memory corruption can lead to arbitrary code execution with elevated privileges. Although the EPSS score of 1.14% suggests lower widespread exploitation compared to network-accessible vulnerabilities, the local nature of this flaw makes it particularly dangerous as a privilege escalation vector on mobile devices where a malicious application could exploit it to gain kernel-level access. The broad range of affected Qualcomm chipsets means that hundreds of millions of Android devices, IoT systems, and automotive platforms are potentially vulnerable.
Exploit Maturity
CVE-2020-11261 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-06-01. The EPSS score of 1.14% (78.3rd percentile) indicates a measurable probability of exploitation, though exploitation is primarily local rather than remote. No public exploit references tagged as "Exploit" are present in the NVD references, suggesting that exploitation may be occurring through targeted attacks rather than widely available public tools. The local attack vector means this vulnerability is most likely exploited through malicious applications installed on affected devices, making it a significant threat in mobile security and targeted espionage scenarios.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Install the Qualcomm security patches referenced in the January 2021 Qualcomm Security Bulletin, which addresses this vulnerability.
- For Android devices, ensure that the latest available security patch level from the device manufacturer has been applied. Contact your device OEM if patches are not yet available for your specific device model, as the fix must be integrated into the device firmware by the manufacturer.
- Restrict application installation to trusted sources (Google Play Store or enterprise MDM-managed apps) and enforce application vetting policies to minimize the risk of malicious applications exploiting this local vulnerability.
- Monitor devices for indicators of compromise including unexpected application crashes, unusual memory consumption patterns, and signs of privilege escalation or unauthorized data access.
- For IoT and industrial deployments using affected Snapdragon chipsets, implement network segmentation to isolate vulnerable devices and apply firmware updates as they become available from the device manufacturer.
Technical Details
CVE-2020-11261 is a memory corruption vulnerability in Qualcomm Snapdragon chipset firmware caused by improper input validation during memory allocation operations. When a user-space application requests a memory allocation of an excessively large size through the graphics or display driver, the system fails to properly validate the size parameter and return an appropriate error. This leads to an out-of-bounds write condition (CWE-787) where data is written beyond the intended buffer boundaries, corrupting adjacent memory structures. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that while the attack requires local access with low privileges, exploitation is straightforward and results in full compromise of the device. The combination of improper input validation (CWE-20) and out-of-bounds write (CWE-787) creates a reliable exploitation primitive that can be leveraged for privilege escalation from a user-space application to kernel-level code execution.
Frequently Asked Questions
Is CVE-2020-11261 being actively exploited?
Yes. CVE-2020-11261 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 1.14% (78.3rd percentile) indicates a measurable probability of exploitation, primarily through malicious applications targeting affected mobile and IoT devices.
What products are affected by CVE-2020-11261?
CVE-2020-11261 affects a wide range of Qualcomm Snapdragon chipset product lines including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables. Specific affected firmware includes APQ8009, APQ8017, APQ8053, APQ8096AU, MSM8909W, MSM8917, MSM8920, and many additional Qualcomm chipsets.
How do I fix CVE-2020-11261?
Apply the security patches referenced in the Qualcomm January 2021 Security Bulletin. For Android devices, install the latest available security update from your device manufacturer. For IoT devices, contact the device vendor for firmware updates that incorporate the Qualcomm fix.
How severe is CVE-2020-11261?
CVE-2020-11261 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, the low complexity and ability to achieve full system compromise make it a serious privilege escalation threat on the billions of devices using affected Qualcomm chipsets.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.