CVE-2019-14117
u'Whenever the page list is updated via privileged user, the previous list elements are freed but...
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, MDM9607, QCS405, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, MDM9607, QCS405, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
- Record
CVE-2019-14117- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, MDM9607, QCS405, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
- Record
CVE-2019-14117- Updated
- 2026-11-02
EUVDEUVD-2019-5370 No score
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, MDM9607, QCS405, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
- Record
EUVD-2019-5370- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hwmg-8436-r7fw No score
u'Whenever the page list is updated via privileged user, the previous list elements are freed but...
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, MDM9607, QCS405, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
- Record
GHSA-hwmg-8436-r7fw- Updated
- 2026-11-02
Affected products
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables
- qualcomm bitra firmware
- qualcomm mdm9607 firmware
- qualcomm qcs405 firmware
- qualcomm saipan firmware
- qualcomm sc8180x firmware
- qualcomm sdx55 firmware
- qualcomm sm6150 firmware
- qualcomm sm7150 firmware
- qualcomm sm8150 firmware
- qualcomm sm8250 firmware
- qualcomm sxr2130 firmware
Affected packages
| Package | Affected | Fixed |
|---|---|---|
:linux_kernel:QualcommAndroid |
SoCVersion:0 up to SoCVersion:2020-09-05, plus listed versions SoCVersion |
SoCVersion:2020-09-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14117 is a high vulnerability (CVSS 7.8) in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, published September 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in :linux_kernel:Qualcomm SoCVersion:2020-09-05.
References
qualcomm.com/company/product-security/bulletins/august-2020-bulletin
nvd.nist.gov/vuln/detail/CVE-2019-14117
github.com/advisories/GHSA-hwmg-8436-r7fw
source.android.com/security/bulletin/2020-09-01
source.codeaurora.org/quic/la/kernel/msm-4.14/commit?id=06d7c43e7e4e224ab96bb1e069d495a8dd95c60a