Junglewise Threat Intelligence

CVE-2021-1906: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

CVE-2021-1906 · Severity: critical · CVSS 6.2 · Exploited in the wild · Published 2021-11-03

Technologies: Qualcomm Snapdragon Connectivity, Qualcomm Multiple Chipsets, Qualcomm Snapdragon Compute, Qualcomm Snapdragon Mobile, Qualcomm Snapdragon Consumer IOT, Qualcomm Snapdragon Wearables, Qualcomm Snapdragon Industrial IOT, Qualcomm Snapdragon Auto. Vendors: Qualcomm.

Executive brief

Multiple Qualcomm chipsets contain a vulnerability where improper handling of GPU address deregistration during a failure condition can lead to subsequent allocation failures. This detection of error condition without action can result in a denial of service for GPU resources.

Affected products

  • Qualcomm Snapdragon Auto
  • Qualcomm Snapdragon Compute
  • Qualcomm Snapdragon Connectivity
  • Qualcomm Snapdragon Consumer IOT
  • Qualcomm Snapdragon Industrial IOT
  • Qualcomm Snapdragon Mobile
  • Qualcomm Snapdragon Voice & Music
  • Qualcomm Snapdragon Wearables
  • Qualcomm APQ8009 Firmware
  • Qualcomm APQ8009W Firmware

Timeline

  • 2021-05-01: patched: Qualcomm released a security bulletin in May 2021 addressing the issue.
  • 2021-11-03: disclosed: NVD publication date.
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
  • 2021-11-03: exploited: Reported as exploited in the wild.

Related threats