CVE-2020-3645 : What You Need to Know

A firmware issue in WLAN firmware affecting multiple Qualcomm products and versions.

Understanding CVE-2020-3645

A vulnerability in WLAN firmware can lead to firmware assertion due to encrypted data length in FILS IE of reassoc response exceeding 528 bytes.

What is CVE-2020-3645?

The vulnerability triggers a firmware assertion in WLAN firmware when encountering encrypted data length issues in specific Qualcomm products and versions.

The Impact of CVE-2020-3645

The vulnerability can potentially lead to a denial of service (DoS) condition, impacting the availability of the affected devices and systems.

Technical Details of CVE-2020-3645

A detailed overview of the technical aspects of the CVE.

Vulnerability Description

Firmware assertion in WLAN firmware due to encrypted data length in FILS IE of reassoc response exceeding 528 bytes.

Affected Systems and Versions

Products: Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Versions: IPQ6018, IPQ8074, Kamorta, Nicobar, QCA6390, QCA8081, QCN7605, QCS404, QCS405, QCS605, Rennell, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130

Exploitation Mechanism

The vulnerability can be exploited by crafting a malicious reassoc response with encrypted data length exceeding the specified threshold, triggering the firmware assertion.

Mitigation and Prevention

Measures to address and prevent the CVE.

Immediate Steps to Take

Apply patches provided by Qualcomm to address the firmware issue promptly.
Monitor vendor communications for any updates or advisories related to this vulnerability.

Long-Term Security Practices

Regularly update firmware and software to mitigate potential vulnerabilities.
Implement network segmentation and access controls to limit the impact of potential attacks.

Patching and Updates

Ensure timely installation of firmware updates and patches released by Qualcomm to mitigate the vulnerability effectively.