SB2021090616 - Multiple vulnerabilities in Qualcomm chipsets 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021090616

SB2021090616 - Multiple vulnerabilities in Qualcomm chipsets

Published: September 6, 2021 Updated: September 14, 2022

Security Bulletin ID SB2021090616
Severity
High
Patch available
YES
Number of vulnerabilities 20
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 25% Low 65%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 20 secuirty vulnerabilities.


1) Buffer Over-read (CVE-ID: CVE-2021-1941)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper length check on WPA IE string sent by peer within the WLAN Host Communication component. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.


2) Buffer Over-read (CVE-ID: CVE-2021-1948)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to lack of length check of data while parsing the beacon or probe response within the WLAN Host Communication component. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.


3) Buffer Over-read (CVE-ID: CVE-2021-1971)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to lack of physical layer state validation within the WLAN HAL. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.


4) Buffer Over-read (CVE-ID: CVE-2021-1974)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU within the WLAN Host Communication component. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.


5) Buffer overflow (CVE-ID: CVE-2021-30295)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of local variable while storing current task information locally within the DSP Service. A local user can perform a denial of service attack or corrupt files on the system.


6) Buffer overflow (CVE-ID: CVE-2021-1961)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to lack of offset length check while updating the buffer value within the HLOS component. A local user can execute arbitrary code with elevated privileges.


7) Buffer overflow (CVE-ID: CVE-2021-1962)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error while processing IOCTL for getting peripheral endpoint information within the Data Network Stack & Connectivity component. A local user can execute arbitrary code with elevated privileges.


8) Use-after-free (CVE-ID: CVE-2021-1963)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error caused by the lack of validation for the rule count in filter table in IPA driver in Data Network Stack & Connectivity component. A local user can escalate privileges on the system.


9) Improper Validation of Array Index (CVE-ID: CVE-2021-1933)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of invite message with SDP body within the Data Modem component. A remote attacker can send specially crafted data to the system, trigger memory corruption and execute arbitrary code on the system.


10) NULL pointer dereference (CVE-ID: CVE-2021-1946)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a NULL pointer dereference error while processing crafted SDP body within the Data Modem component. A remote attacker can send specially crafted data to the system and execute arbitrary code.


11) Buffer overflow (CVE-ID: CVE-2021-1909)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to lack of length check of parameters passed from trusted applications within the Core component. A local application can trigger a buffer overflow and execute arbitrary code with elevated privileges.


12) Double Free (CVE-ID: CVE-2021-1934)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within Digital Rights Management in Content Protection due to improper check when application loader object is explicitly destructed while application is unloading. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.


13) NULL pointer dereference (CVE-ID: CVE-2021-1935)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error during key import in HLOS component. A local user can pass specially crafted data to the system and perform a denial of service (DoS) attack.


14) Buffer overflow (CVE-ID: CVE-2021-1952)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Boot subsystem. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.


15) Improper access control (CVE-ID: CVE-2021-1956)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of ASB-U packet with L2CAP channel ID by slave host. A remote attacker with physical proximity to device can interference with piconet and perform a denial of service attack.


16) Input validation error (CVE-ID: CVE-2021-1960)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of ASB-C broadcast packets with crafted opcode in LMP in BT Controller. A remote attacker can pass specially crafted input to the system and perform a denial of service (DoS) attack.


17) NULL pointer dereference (CVE-ID: CVE-2021-30290)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error caused by race condition between timeline fence signal and time line fence destroy in Graphics subsystem. A local user can perform a denial of service (DoS) attack.


18) NULL pointer dereference (CVE-ID: CVE-2021-30294)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in KGSL GPU auxiliary command within the Graphics subsystem. A local user can perform a denial of service (DoS) attack.


19) Improper access control (CVE-ID: CVE-2021-1957)

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device. A local user can per form a denial of service (DoS) attack.


20) Use-after-free (CVE-ID: CVE-2021-1958)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error caused by a race condition in fastrpc kernel driver for dynamic process creation in DSP Service. A local user can escalate privileges on the system.


Remediation

Install update from vendor's website.

References