Junglewise Threat Intelligence

CVE-2021-1905: Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CVE-2021-1905 · Severity: critical · CVSS 8.4 · Exploited in the wild · Published 2021-11-03

Technologies: Qualcomm Snapdragon Connectivity, Qualcomm Multiple Chipsets, Qualcomm Snapdragon Compute, Qualcomm Snapdragon Mobile, Qualcomm Snapdragon Consumer IOT, Qualcomm Snapdragon Wearables, Qualcomm Snapdragon Industrial IOT, Qualcomm Snapdragon Auto. Vendors: Qualcomm.

Executive brief

A use-after-free vulnerability exists in multiple Qualcomm Snapdragon chipsets due to improper handling of memory mapping when multiple processes are handled simultaneously. This flaw could allow a local attacker to potentially gain elevated privileges or cause a system crash.

Affected products

  • Qualcomm Snapdragon Auto
  • Qualcomm Snapdragon Compute
  • Qualcomm Snapdragon Connectivity
  • Qualcomm Snapdragon Consumer IOT
  • Qualcomm Snapdragon Industrial IOT
  • Qualcomm Snapdragon Mobile
  • Qualcomm Snapdragon Voice & Music
  • Qualcomm Snapdragon Wearables
  • Qualcomm APQ8009 Firmware -
  • Qualcomm APQ8009W Firmware -

Timeline

  • 2021-05-01: patched: Qualcomm released a security bulletin in May 2021 addressing the issue.
  • 2021-11-03: disclosed: NVD publication date.
  • 2021-11-03: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.
  • 2021-11-03: exploited: Confirmed as exploited in the wild per CISA and advisory metadata.

Related threats