CVE-2020-11179: Qualcomm Apq8009 Race Condition Flaw

CVE-2020-11179 Overview

CVE-2020-11179 is a kernel memory corruption vulnerability affecting a wide range of Qualcomm Snapdragon chipsets. The flaw allows a local attacker with low privileges to perform arbitrary reads and writes to kernel addresses by temporarily overwriting a ring buffer pointer and exploiting a race condition. The issue impacts Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables product lines. Qualcomm addressed the issue in its December 2020 security bulletin. The vulnerability is classified under CWE-125 (Out-of-Bounds Read) and has an EPSS probability of 2.099% (84th percentile).

Critical Impact
A successful attacker gains arbitrary kernel read/write primitives, leading to full kernel compromise, privilege escalation, and persistent device takeover on hundreds of Snapdragon SoCs.

Affected Products

Qualcomm Snapdragon Mobile platforms including SD 820, SD 835, SD 845, SD 855, SD 865, and SM7350
Qualcomm Snapdragon Auto platforms including SA6155P, SA8155P, and SA8195P
Qualcomm Snapdragon Compute, Connectivity, Consumer IOT, Industrial IOT, Voice & Music, and Wearables chipsets (full list in Qualcomm advisory)

Discovery Timeline

2021-01-21 - CVE-2020-11179 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-11179

Vulnerability Analysis

The vulnerability resides in a kernel driver shipped with Qualcomm Snapdragon chipsets. The driver maintains a ring buffer whose head and tail pointers are used to track producer and consumer positions during inter-process or device-to-kernel communication. An attacker with local code execution and low privileges can temporarily overwrite the ring buffer pointer to reference attacker-controlled memory. Because the pointer validation and the pointer dereference are not performed atomically, a parallel thread can race the validation step and force the kernel to read from or write to the manipulated address before checks complete. The result is a primitive that yields arbitrary kernel-mode read and write access.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition combined with insufficient bounds checking on a ring buffer pointer ([CWE-125]). The driver validates the pointer once but reuses the cached value after a context switch, allowing concurrent threads to substitute the pointer between validation and use.

Attack Vector

Exploitation requires local access and low-privileged code execution on the target device, such as an unprivileged Android application or a compromised user-space service. The attacker spawns two threads: one issues legitimate ring buffer operations while the second races to overwrite the pointer at the precise moment between validation and dereference. Successful exploitation yields kernel-level read/write primitives, which can be chained with additional gadgets to achieve full kernel code execution, defeat SELinux enforcement, and establish persistence. See the Qualcomm December 2020 Security Bulletin for the vendor's description.

// Conceptual race condition pattern - illustrative only
// Thread A: issue legitimate ring buffer ioctl
//   driver validates ring->ptr against allowed region
//   <-- race window -->
//   driver dereferences ring->ptr to read/write kernel data
//
// Thread B: overwrite ring->ptr with attacker-controlled kernel address
//
// Result: driver performs read/write at attacker-chosen kernel address

Detection Methods for CVE-2020-11179

Indicators of Compromise

Unexpected kernel panics or driver crashes referencing Qualcomm ring buffer or shared memory driver components
Unprivileged Android applications spawning multiple threads issuing rapid ioctl calls to Qualcomm kernel drivers
Anomalous SELinux denials immediately preceding privilege escalation events

Detection Strategies

Monitor kernel logs (dmesg, logcat -b kernel) for repeated faults or warnings originating in Qualcomm driver code paths
Inspect mobile device management (MDM) telemetry for processes accessing privileged device nodes from non-system UIDs
Correlate sudden privilege transitions on Android devices with preceding bursts of driver-level system calls

Monitoring Recommendations

Enable verbose audit logging on Qualcomm-driver-related device nodes and forward to a centralized log analytics platform
Track firmware and patch level (ro.build.version.security_patch) across fleet inventories to identify devices still running pre-December 2020 builds
Alert on installations of applications requesting unusual native code execution privileges on managed mobile endpoints

How to Mitigate CVE-2020-11179

Immediate Actions Required

Apply the December 2020 Android security patch level or later on every Snapdragon-based device under management
Inventory all Snapdragon SoCs listed in the Qualcomm advisory and prioritize patching devices that cannot be replaced
Restrict installation of untrusted applications on affected devices until vendor patches are confirmed deployed

Patch Information

Qualcomm released fixes in the December 2020 Security Bulletin. Device OEMs must integrate the corrected driver into their firmware images and ship updates through their normal over-the-air update channels. Confirm patch deployment by verifying the Android security patch level reports December 2020 or later.

Workarounds

No effective workaround exists short of applying the vendor patch; restrict device usage to trusted application sources
Enforce mobile application allowlisting through enterprise MDM policy to reduce the likelihood of local code execution
Decommission end-of-life devices that will no longer receive vendor firmware updates

bash

# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output: 2020-12-01 or later