CVE-2021-1906: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

CVE-2021-1906 · Severity: critical · CVSS 6.2 · Exploited in the wild · Published 2021-11-03

Multiple Qualcomm chipsets contain a vulnerability where improper handling of GPU address deregistration during a failure condition can lead to subsequent allocation failures. This detection of error condition without action can result in a denial of service for GPU resources.

Technologies: Qualcomm Multiple Chipsets. Vendors: Qualcomm.

Quick answers

Is CVE-2021-1906 exploited in the wild?
Yes. CVE-2021-1906 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2021-1906?
Critical severity, with a CVSS score of 6.2, published 3 November 2021.
Which products and versions are affected?
Qualcomm Snapdragon Auto; Qualcomm Snapdragon Compute; Qualcomm Snapdragon Connectivity; Qualcomm Snapdragon Consumer IOT; and 6 more.
Is there a fix for CVE-2021-1906?
A patch was published on 2021-05-01: Qualcomm released a security bulletin in May 2021 addressing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-1906 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2021-1906?
Check whether you run Qualcomm Multiple Chipsets. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Qualcomm Snapdragon Auto
  • Qualcomm Snapdragon Compute
  • Qualcomm Snapdragon Connectivity
  • Qualcomm Snapdragon Consumer IOT
  • Qualcomm Snapdragon Industrial IOT
  • Qualcomm Snapdragon Mobile
  • Qualcomm Snapdragon Voice & Music
  • Qualcomm Snapdragon Wearables
  • Qualcomm APQ8009 Firmware
  • Qualcomm APQ8009W Firmware

Timeline

  • 2021-05-01: patched: Qualcomm released a security bulletin in May 2021 addressing the issue.
  • 2021-11-03: disclosed: NVD publication date.
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
  • 2021-11-03: exploited: Reported as exploited in the wild.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.