Qualcomm TZ Secure OS Memory Corruption Vulnerability Allowing Buffer Over-read

A memory corruption vulnerability has been identified in the Qualcomm TZ Secure OS, specifically while processing a GP command response. This issue arises from an incorrect calculation of buffer size, leading to potential memory corruption.

Impact

Exploitation of this vulnerability causes memory corruption, which can lead to arbitrary code execution or other unintended behavior by corrupting memory management, potentially allowing for exploitation of other vulnerabilities or causing a denial-of-service condition.

Remediation

Qualcomm has notified device manufacturers about this vulnerability and recommended that they deploy patches as soon as possible. For information on the patching status of released devices, contact the device manufacturer.