BDU:2025-00198

Опубликовано: 12 фев. 2024

Источник: fstec

CVSS3: 8.4

CVSS2: 7.2

EPSS Низкий

Описание

Уязвимость регистра SMR/S2CR микропрограммного обеспечения процессоров безопасности Qualcomm связана с непроверенным индексированием массива. Эксплуатация уязвимости может позволить нарушителю оказывать влияние на целостность, доступность и конфиденциальность на защищаемую информацию

Вендор

Qualcomm Technologies Inc.

Lenovo Group Limited

Наименование ПО

Qualcomm SDX55

Qualcomm SXR2130

Qualcomm SDM429W

SD 8 Gen1 5G

WCD9380

AQT1000

AR8035

Qualcomm SD865 5G

Qualcomm SD888

Qualcomm SM7250P

Qualcomm SM7315

Qualcomm SM7325P

Qualcomm WCD9340

Qualcomm WCD9341

Qualcomm WCD9370

Qualcomm WCD9375

Qualcomm WCD9385

Qualcomm WCN3988

Qualcomm WCN6740

Qualcomm WSA8810

Qualcomm WSA8815

Qualcomm WSA8830

Qualcomm WSA8835

Qualcomm WCD9326

Qualcomm WCN3660B

Qualcomm WCN3680B

Qualcomm WCN3950

Qualcomm WCN3980

Qualcomm WSA8832

SD675

SD730

Qualcomm SD855

Qualcomm SM6250

Qualcomm SM6250P

Qualcomm WCD9360

WCD9371

Qualcomm WCN3990

SD670

Qualcomm WCN3620

Snapdragon 429 Mobile Platform

Snapdragon 855 Mobile Platform

Snapdragon 855+/860 Mobile Platform (SM8150-AC)

Snapdragon 865 5G Mobile Platform

Snapdragon 865+ 5G Mobile Platform (SM8250-AB)

Snapdragon 870 5G Mobile Platform (SM8250-AC)

Snapdragon Wear 4100+ Platform

Snapdragon X55 5G Modem-RF System

Snapdragon XR2 5G Platform

Snapdragon Auto 4G Modem

QSM8250

Snapdragon X50 5G Modem-RF System

Snapdragon 8 Gen 1 Mobile Platform

Snapdragon 888 5G Mobile Platform

Snapdragon 888+ 5G Mobile Platform (SM8350-AC)

Snapdragon 765G 5G Mobile Platform (SM7250-AB)

Snapdragon 768G 5G Mobile Platform (SM7250-AC)

Qualcomm SDX57M

Snapdragon 670 Mobile Platform

Snapdragon 675 Mobile Platform

Snapdragon 678 Mobile Platform (SM6150-AC)

Snapdragon 690 5G Mobile Platform

Snapdragon 720G Mobile Platform

Snapdragon 730 Mobile Platform (SM7150-AA)

Snapdragon 730G Mobile Platform (SM7150-AB)

Snapdragon 732G Mobile Platform (SM7150-AC)

Snapdragon 750G 5G Mobile Platform

Snapdragon 778G 5G Mobile Platform

Snapdragon 778G+ 5G Mobile Platform (SM7325-AE)

Snapdragon 780G 5G Mobile Platform

Snapdragon 782G Mobile Platform (SM7325-AF)

Snapdragon 7c Compute Platform (SC7180-AC)

Snapdragon 7c Gen 2 Compute Platform (SC7180-AD) "Rennell Pro"

Snapdragon 7c+ Gen 3 Compute Platform

Snapdragon 845 Mobile Platform

Snapdragon 850 Mobile Compute Platform

Snapdragon 8c Compute Platform (SC8180X-AD) "Poipu Lite"

Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite"

Snapdragon 8cx Compute Platform (SC8180X-AA, AB)

Snapdragon 8cx Compute Platform (SC8180XP-AC, AF) "Poipu Pro"

Snapdragon 8cx Gen 2 5G Compute Platform (SC8180X-AC, AF) "Poipu Pro"

Snapdragon 8cx Gen 2 5G Compute Platform (SC8180XP-AA, AB)

Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB)

Snapdragon AR2 Gen 1 Platform

Snapdragon X24 LTE Modem

Snapdragon X65 5G Modem-RF System

Snapdragon XR2+ Gen 1 Platform

Qualcomm SSG2115P

Qualcomm SSG2125P

Qualcomm SXR1230P

Qualcomm Vision Intelligence 300 Platform

Qualcomm Vision Intelligence 400 Platform

Qualcomm® Video Collaboration VC1 Platform

Qualcomm® Video Collaboration VC3 Platform

Snapdragon X75 5G Modem-RF System

Qualcomm WCD9390

Qualcomm WCD9395

Qualcomm WSA8840

Qualcomm WSA8845

Qualcomm WSA8845H

QCN9100

SA4155P

SA8770P

QCA6564AU

QCA6574

QCA6574A

QCA6574AU

QCA6584AU

QCA6678AQ

Qualcomm® Video Collaboration VC5 Platform

Snapdragon 8 Gen 3 Mobile Platform

Snapdragon Auto 5G Modem-RF Gen 2

Snapdragon X35 5G Modem-RF System

SA4150P

SA8775P

QCS8155

QAM8620P

SA7775P

SA8620P

SA8650P

Snapdragon X62 5G Modem-RF System

Snapdragon X72 5G Modem-RF System

SRV1H

SRV1L

SRV1M

QCA6688AQ

SA8530P

HX645 V3 Integrated System (ThinkAgile)

HX665 V3 Certified Node (ThinkAgile)

HX3375 Appliance

HX3376 Certified Node

HX665 V3 Integrated System (ThinkAgile)

HX665 V3 Storage Certified Node (ThinkAgile)

HX665 V3 Storage Integrated Node (ThinkAgile)

VX635 V3 Integrated System (ThinkAgile)

VX635 V3 Certified Node (ThinkAgile)

VX645 V3 Certified Node (ThinkAgile)

VX645 V3 Integrated System (ThinkAgile)

VX655 V3 Certified Node (ThinkAgile)

VX655 V3 Integrated System (ThinkAgile)

SE455 V3 (ThinkEdge)

X13s (Type 21BX, 21BY) Laptop (ThinkPad)

SD535 V3 (ThinkSystem)

SD665 V3 (ThinkSystem)

Lenovo ThinkSystem SR635

SR635 V3 (ThinkSystem)

Lenovo ThinkSystem SR645

SR645 V3 (ThinkSystem)

Lenovo ThinkSystem SR655

SR655 V3 (ThinkSystem)

Lenovo ThinkSystem SR665

SR665 V3 (ThinkSystem)

SR675 V3 (ThinkSystem)

HX645 V3 Certified Node (ThinkAgile)

FastConnect 6700

FastConnect 6900

QAM8255P

QAM8295P

QAM8650P

QAM8775P

QAMSRV1H

QAMSRV1M

QCA6595

QCA6595AU

QCA6696

QCA6698AQ

QCA6797AQ

QCA8081

QCA8337

QCC710

QCM5430

QCM6490

QCM8550

QCN6224

QCN6274

QCN9012

QCN9274

QCS410

QCS610

QCS6490

QCS8550

QFW7114

QFW7124

SA6155P

SA7255P

SA8155P

SA8195P

SA8255P

SA8295P

SA8540P

SA9000P

FastConnect 6200

FastConnect 6800

Flight RB5 5G Platform

QCA6174A

QCA6391

QCA6420

QCA6421

QCA6426

QCA6430

QCA6431

QCA6436

QCN9011

QCS7230

QCS8250

QDU1000

QDU1010

QDU1110

QDU1210

QDX1010

QDX1011

QEP8111

QRB5165M

QRB5165N

QRU1032

QRU1052

QRU1062

QSM8350

Robotics RB5 Platform

SA6145P

SA6150P

SA6155

SA8145P

SA8150P

SC8380XP

315 5G IoT Modem

CSRB31024

Robotics RB3 Platform

SC8180X+SDX55

SD 8CX

QCA6310

QCA6335

QCA6564A

QCA9377

QCA6564

Версия ПО

- (Qualcomm SDX55)

- (Qualcomm SXR2130)

- (Qualcomm SDM429W)

- (SD 8 Gen1 5G)

- (WCD9380)

- (AQT1000)

- (AR8035)

- (Qualcomm SD865 5G)

- (Qualcomm SD888)

- (Qualcomm SM7250P)

- (Qualcomm SM7315)

- (Qualcomm SM7325P)

- (Qualcomm WCD9340)

- (Qualcomm WCD9341)

- (Qualcomm WCD9370)

- (Qualcomm WCD9375)

- (Qualcomm WCD9385)

- (Qualcomm WCN3988)

- (Qualcomm WCN6740)

- (Qualcomm WSA8810)

- (Qualcomm WSA8815)

- (Qualcomm WSA8830)

- (Qualcomm WSA8835)

- (Qualcomm WCD9326)

- (Qualcomm WCN3660B)

- (Qualcomm WCN3680B)

- (Qualcomm WCN3950)

- (Qualcomm WCN3980)

- (Qualcomm WSA8832)

- (SD675)

- (SD730)

- (Qualcomm SD855)

- (Qualcomm SM6250)

- (Qualcomm SM6250P)

- (Qualcomm WCD9360)

- (WCD9371)

- (Qualcomm WCN3990)

- (SD670)

- (Qualcomm WCN3620)

- (Snapdragon 429 Mobile Platform)

- (Snapdragon 855 Mobile Platform)

- (Snapdragon 855+/860 Mobile Platform (SM8150-AC))

- (Snapdragon 865 5G Mobile Platform)

- (Snapdragon 865+ 5G Mobile Platform (SM8250-AB))

- (Snapdragon 870 5G Mobile Platform (SM8250-AC))

- (Snapdragon Wear 4100+ Platform)

- (Snapdragon X55 5G Modem-RF System)

- (Snapdragon XR2 5G Platform)

- (Snapdragon Auto 4G Modem)

- (QSM8250)

- (Snapdragon X50 5G Modem-RF System)

- (Snapdragon 8 Gen 1 Mobile Platform)

- (Snapdragon 888 5G Mobile Platform)

- (Snapdragon 888+ 5G Mobile Platform (SM8350-AC))

- (Snapdragon 765G 5G Mobile Platform (SM7250-AB))

- (Snapdragon 768G 5G Mobile Platform (SM7250-AC))

- (Qualcomm SDX57M)

- (Snapdragon 670 Mobile Platform)

- (Snapdragon 675 Mobile Platform)

- (Snapdragon 678 Mobile Platform (SM6150-AC))

- (Snapdragon 690 5G Mobile Platform)

- (Snapdragon 720G Mobile Platform)

- (Snapdragon 730 Mobile Platform (SM7150-AA))

- (Snapdragon 730G Mobile Platform (SM7150-AB))

- (Snapdragon 732G Mobile Platform (SM7150-AC))

- (Snapdragon 750G 5G Mobile Platform)

- (Snapdragon 778G 5G Mobile Platform)

- (Snapdragon 778G+ 5G Mobile Platform (SM7325-AE))

- (Snapdragon 780G 5G Mobile Platform)

- (Snapdragon 782G Mobile Platform (SM7325-AF))

- (Snapdragon 7c Compute Platform (SC7180-AC))

- (Snapdragon 7c Gen 2 Compute Platform (SC7180-AD) "Rennell Pro")

- (Snapdragon 7c+ Gen 3 Compute Platform)

- (Snapdragon 845 Mobile Platform)

- (Snapdragon 850 Mobile Compute Platform)

- (Snapdragon 8c Compute Platform (SC8180X-AD) "Poipu Lite")

- (Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite")

- (Snapdragon 8cx Compute Platform (SC8180X-AA, AB))

- (Snapdragon 8cx Compute Platform (SC8180XP-AC, AF) "Poipu Pro")

- (Snapdragon 8cx Gen 2 5G Compute Platform (SC8180X-AC, AF) "Poipu Pro")

- (Snapdragon 8cx Gen 2 5G Compute Platform (SC8180XP-AA, AB))

- (Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB))

- (Snapdragon AR2 Gen 1 Platform)

- (Snapdragon X24 LTE Modem)

- (Snapdragon X65 5G Modem-RF System)

- (Snapdragon XR2+ Gen 1 Platform)

- (Qualcomm SSG2115P)

- (Qualcomm SSG2125P)

- (Qualcomm SXR1230P)

- (Qualcomm Vision Intelligence 300 Platform)

- (Qualcomm Vision Intelligence 400 Platform)

- (Qualcomm® Video Collaboration VC1 Platform)

- (Qualcomm® Video Collaboration VC3 Platform)

- (Snapdragon X75 5G Modem-RF System)

- (Qualcomm WCD9390)

- (Qualcomm WCD9395)

- (Qualcomm WSA8840)

- (Qualcomm WSA8845)

- (Qualcomm WSA8845H)

- (QCN9100)

- (SA4155P)

- (SA8770P)

- (QCA6564AU)

- (QCA6574)

- (QCA6574A)

- (QCA6574AU)

- (QCA6584AU)

- (QCA6678AQ)

- (Qualcomm® Video Collaboration VC5 Platform)

- (Snapdragon 8 Gen 3 Mobile Platform)

- (Snapdragon Auto 5G Modem-RF Gen 2)

- (Snapdragon X35 5G Modem-RF System)

- (SA4150P)

- (SA8775P)

- (QCS8155)

- (QAM8620P)

- (SA7775P)

- (SA8620P)

- (SA8650P)

- (Snapdragon X62 5G Modem-RF System)

- (Snapdragon X72 5G Modem-RF System)

- (SRV1H)

- (SRV1L)

- (SRV1M)

- (QCA6688AQ)

- (SA8530P)

- (HX645 V3 Integrated System (ThinkAgile))

- (HX665 V3 Certified Node (ThinkAgile))

- (HX3375 Appliance)

- (HX3376 Certified Node)

- (HX665 V3 Integrated System (ThinkAgile))

- (HX665 V3 Storage Certified Node (ThinkAgile))

- (HX665 V3 Storage Integrated Node (ThinkAgile))

- (VX635 V3 Integrated System (ThinkAgile))

- (VX635 V3 Certified Node (ThinkAgile))

- (VX645 V3 Certified Node (ThinkAgile))

- (VX645 V3 Integrated System (ThinkAgile))

- (VX655 V3 Certified Node (ThinkAgile))

- (VX655 V3 Integrated System (ThinkAgile))

- (SE455 V3 (ThinkEdge))

до 1.63 (X13s (Type 21BX, 21BY) Laptop (ThinkPad))

- (SD535 V3 (ThinkSystem))

- (SD665 V3 (ThinkSystem))

до CFE144C (Lenovo ThinkSystem SR635)

- (SR635 V3 (ThinkSystem))

- (Lenovo ThinkSystem SR645)

- (SR645 V3 (ThinkSystem))

до CFE144C (Lenovo ThinkSystem SR655)

- (SR655 V3 (ThinkSystem))

- (Lenovo ThinkSystem SR665)

- (SR665 V3 (ThinkSystem))

- (SR675 V3 (ThinkSystem))

- (HX645 V3 Certified Node (ThinkAgile))

- (FastConnect 6700)

- (FastConnect 6900)

- (QAM8255P)

- (QAM8295P)

- (QAM8650P)

- (QAM8775P)

- (QAMSRV1H)

- (QAMSRV1M)

- (QCA6595)

- (QCA6595AU)

- (QCA6696)

- (QCA6698AQ)

- (QCA6797AQ)

- (QCA8081)

- (QCA8337)

- (QCC710)

- (QCM5430)

- (QCM6490)

- (QCM8550)

- (QCN6224)

- (QCN6274)

- (QCN9012)

- (QCN9274)

- (QCS410)

- (QCS610)

- (QCS6490)

- (QCS8550)

- (QFW7114)

- (QFW7124)

- (SA6155P)

- (SA7255P)

- (SA8155P)

- (SA8195P)

- (SA8255P)

- (SA8295P)

- (SA8540P)

- (SA9000P)

- (FastConnect 6200)

- (FastConnect 6800)

- (Flight RB5 5G Platform)

- (QCA6174A)

- (QCA6391)

- (QCA6420)

- (QCA6421)

- (QCA6426)

- (QCA6430)

- (QCA6431)

- (QCA6436)

- (QCN9011)

- (QCS7230)

- (QCS8250)

- (QDU1000)

- (QDU1010)

- (QDU1110)

- (QDU1210)

- (QDX1010)

- (QDX1011)

- (QEP8111)

- (QRB5165M)

- (QRB5165N)

- (QRU1032)

- (QRU1052)

- (QRU1062)

- (QSM8350)

- (Robotics RB5 Platform)

- (SA6145P)

- (SA6150P)

- (SA6155)

- (SA8145P)

- (SA8150P)

- (SC8380XP)

- (315 5G IoT Modem)

- (CSRB31024)

- (Robotics RB3 Platform)

- (SC8180X+SDX55)

- (SD 8CX)

- (QCA6310)

- (QCA6335)

- (QCA6564A)

- (QCA9377)

- (QCA6564)

Тип ПО

Микропрограммный код

Сетевое средство

Сетевое программное средство

ПО программно-аппаратного средства

Операционные системы и аппаратные платформы

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,2)

Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,4)

Возможные меры по устранению уязвимости

Использование рекомендаций:

Для Lenovo:

https://support.lenovo.com/ru/ru/product_security/ps500678-multi-vendor-bios-security-vulnerabilities-december-2024

Для Qualcomm:

https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 3%

0.00017

Низкий

8.4 High

CVSS3

7.2 High

CVSS2

Связанные уязвимости

CVE-2024-33044

CVSS3: 8.4

nvd

около 1 года назад

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

GHSA-rj89-pvp9-vqg3

CVSS3: 8.4

github

около 1 года назад

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

EPSS

Процентиль: 3%

0.00017

Низкий

8.4 High

CVSS3

7.2 High

CVSS2