Vulnerability in Qualcomm chips allowing attacks on Android devices via Wi-Fi.

In the wireless chip stack of Qualcomm three vulnerabilities have been identified three vulnerabilities, collectively referred to by the code name 'QualPwn'. The first issue (CVE-2019-10539) allows remote attacks on devices based on the Android platform via Wi-Fi. The second issue is present in the proprietary firmware of the Qualcomm wireless stack and allows access to the baseband modem (CVE-2019-10540). The third issue has been present in the icnss driver (CVE-2019-10538) provides the ability to achieve code execution at the kernel level of the Android platform. If the mentioned vulnerabilities are successfully exploited, the attacker can remotely gain control of the user’s device that has Wi-Fi activated (the attack requires both the victim and the attacker to be connected to the same wireless network).

The attack capability has been demonstrated for Google Pixel 2 and Pixel 3 smartphones. According to researchers, the problem potentially affects over 835,000 devices based on the Qualcomm Snapdragon 835 SoC and newer chips (from Snapdragon 835 onward, the WLAN firmware has been integrated with the modem subsystem and executed as an isolated application in user space). By data Qualcomm, the issue affects several dozen different chips.

Currently, only general information about the vulnerabilities is available, and details is planned will be disclosed on August 8 at the Black Hat conference. Qualcomm and Google were notified of the issues in March and have already released patches (Qualcomm informed about the issues in the June report, and Google fixed the vulnerabilities in the August Android platform update). All users of devices with Qualcomm chips are recommended to install the available updates.

In addition to issues related to Qualcomm chips, the August update of the Android platform also addressed a critical vulnerability (CVE-2019-11516) in the Broadcom Bluetooth stack, allowing an attacker to execute their code in the context of a privileged process through the submission of specially crafted data transfer requests. A vulnerability (CVE-2019-2130) in the Android system components allowing for elevated privilege code execution when processing specially crafted PAC files has also been resolved.

Source: opennet.ru