{"id":"CVE-2020-3656","aliases":["2580967","A-157905780","ASB-A-157905780","EUVD-2020-24927","GHSA-j657-99m2-wp3h"],"status":"published","title":"u'Out of bound access can happen in MHI command process due to lack of check of command channel...","description":"Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00227,"percentile":0.13483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2020-09-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":":linux_kernel:Qualcomm","fixed_in":["SoCVersion:2020-09-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":linux_kernel:Qualcomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2020-09-05"}]}],"versions":["SoCVersion"]}],"products":[{"vendor":"qualcomm","product":"apq8009_firmware"},{"vendor":"qualcomm","product":"kamorta_firmware"},{"vendor":"qualcomm","product":"mdm9607_firmware"},{"vendor":"qualcomm","product":"msm8917_firmware"},{"vendor":"qualcomm","product":"msm8953_firmware"},{"vendor":"qualcomm","product":"nicobar_firmware"},{"vendor":"qualcomm","product":"qcm2150_firmware"},{"vendor":"qualcomm","product":"qcs405_firmware"},{"vendor":"qualcomm","product":"qcs605_firmware"},{"vendor":"qualcomm","product":"qm215_firmware"},{"vendor":"qualcomm","product":"rennell_firmware"},{"vendor":"qualcomm","product":"sa6155p_firmware"},{"vendor":"qualcomm","product":"sa8155p_firmware"},{"vendor":"qualcomm","product":"saipan_firmware"},{"vendor":"qualcomm","product":"sc8180x_firmware"},{"vendor":"qualcomm","product":"sdm429_firmware"},{"vendor":"qualcomm","product":"sdm429w_firmware"},{"vendor":"qualcomm","product":"sdm439_firmware"},{"vendor":"qualcomm","product":"sdm450_firmware"},{"vendor":"qualcomm","product":"sdm632_firmware"},{"vendor":"qualcomm","product":"sdm710_firmware"},{"vendor":"qualcomm","product":"sdm845_firmware"},{"vendor":"qualcomm","product":"sdx55_firmware"},{"vendor":"qualcomm","product":"sm6150_firmware"},{"vendor":"qualcomm","product":"sm7150_firmware"},{"vendor":"qualcomm","product":"sm8150_firmware"},{"vendor":"qualcomm","product":"sm8250_firmware"},{"vendor":"qualcomm","product":"sxr2130_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice \u0026 music, snapdragon wearables"}],"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletin","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3656"},{"url":"https://github.com/advisories/GHSA-j657-99m2-wp3h"},{"url":"https://source.android.com/security/bulletin/2020-09-01","tags":["advisory"]},{"url":"https://source.codeaurora.org/quic/la/kernel/msm-4.14/commit/?id=e98a048a50f022181e008c60fea0c9cdee83e05a","tags":["fix"]}],"sources":{"cve":[{"id":"CVE-2020-3656","description":"Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130","status":"published","published":"2020-09-09T06:25:20Z","modified":"2024-08-04T07:44:50.134Z","updated_at":"2026-11-02T14:35:51.923913Z"}],"euvd":[{"id":"EUVD-2020-24927","description":"Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130","status":"published","published":"2020-09-09T06:25:20Z","modified":"2024-08-04T07:44:50Z","updated_at":"2026-11-03T03:08:09.450574Z"}],"ghsa":[{"id":"GHSA-j657-99m2-wp3h","title":"u'Out of bound access can happen in MHI command process due to lack of check of command channel...","description":"u'Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130","status":"published","published":"2022-05-24T17:27:42Z","modified":"2023-01-29T05:03:46Z","updated_at":"2026-11-02T14:45:23.726919Z"}],"nvd":[{"id":"CVE-2020-3656","description":"Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130","status":"published","published":"2020-09-09T07:15:10.11Z","modified":"2026-06-17T03:18:47.73Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"ASB-A-157905780","status":"published","published":"2020-09-01T00:00:00Z","modified":"2026-11-05T16:32:28.703711716Z","updated_at":"2026-11-05T17:55:14.18208Z"}]}}