A Qualcomm chip wireless stack three vulnerabilities introduced under the code name 'QualPwn'. The first issue (CVE-2019-10539) allows remote attacks on devices based on the Android platform via Wi-Fi. The second problem exists in the proprietary firmware with the Qualcomm wireless stack and allows access to the baseband modem (CVE-2019-10540). The third issue in the icnss driver (CVE-2019-10538) enables the execution of arbitrary code at the kernel level of the Android platform. In case of successful exploitation of the combination of the above vulnerabilities, the attacker can remotely gain control over the user's device where Wi-Fi is active (the attack requires both the victim and the attacker to be connected to the same wireless network).
The attack capability has been demonstrated on Google Pixel2 and Pixel3 smartphones. According to researchers, the problem potentially affects more than 835,000 devices based on the Qualcomm Snapdragon 835 SoC and newer chips (starting with Snapdragon 835, WLAN firmware has been integrated with the modem subsystem and executed as an isolated user-space application). According to Qualcomm, the issue affects several dozen different chips.
Currently, only general information about the vulnerabilities is available, and details will be disclosed on August 8 at the Black Hat conference. Qualcomm and Google were notified about the issues in March and have already managed to release fixes (Qualcomm reported the issues in the , while Google fixed the vulnerabilities in the Android platform update). All users of devices with Qualcomm chips are recommended to install the available updates.
In addition to the issues related to Qualcomm chips, the August update of the Android platform also fixed a critical vulnerability (CVE-2019-11516) in the Broadcom Bluetooth stack, allowing an attacker to execute their code in the context of a privileged process by sending a specially crafted data transfer request. A vulnerability (CVE-2019-2130) has been fixed in the Android system components, allowing code execution with elevated privileges when processing specially formatted PAC files.
Forrás: opennet.ru
