SB2022030719 - Multiple vulnerabilities in Qualcomm chipsets 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022030719

SB2022030719 - Multiple vulnerabilities in Qualcomm chipsets

Published: March 7, 2022

Security Bulletin ID SB2022030719
Severity
High
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 31% Low 63%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2021-30333)

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing EFS files within the Multi-Mode Call Processor. A local application can trigger memory corruption and execute arbitrary code on the target system.



2) Buffer overflow (CVE-ID: CVE-2021-35103)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper validation of number of timer values received from firmware while syncing timers in the WLAN Host Communication component. A malicious application can trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Out-of-bounds read (CVE-ID: CVE-2021-35088)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the WLAN Host Communication component during SSID IE parse when channel is DFS. A remote attacker can send specially crafted packets to the device, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.


4) Information disclosure (CVE-ID: CVE-2021-30331)

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Data Modem. A local application can send a specially crafted external command via DIAG interface and gain unauthorized access to sensitive information on the system.


5) Out-of-bounds read (CVE-ID: CVE-2021-35106)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary condition in the WLAN Host component when calculating length of WMI messages. A local application can send an overly long WMI message to trigger an out-of-bounds read error and execute arbitrary code with elevated privileges.


6) Out-of-bounds read (CVE-ID: CVE-2021-35117)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the WLAN Host while processing an IBSS beacon. A remote attacker can send specially crafted packets to the device, trigger an out-of-bounds read error and read contents of memory on the system.


7) Type conversion (CVE-ID: CVE-2021-35105)

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to a type conversion error in the Graphics component during graphics profiling. A malicious application can trigger a boundary error and escalate privileges on the system.


8) Input validation error (CVE-ID: CVE-2021-30299)

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the Audio component. A local application can trigger a boundary error and execute arbitrary code with elevated privileges.


9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-1942)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due improper handling of permissions of a shared memory region in the Core subsystem. A local application can execute arbitrary code with elevated privileges.


10) Buffer overflow (CVE-ID: CVE-2021-35089)

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to a boundary error in the Automotive Multimedia. A malicious application can supply a specially crafted command and execute arbitrary code on the system.


11) Type conversion (CVE-ID: CVE-2021-35110)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a type conversion error in the Boot subsystem when validating hash segment of file. A malicious application can supply a specially crafted file and execute arbitrary code on the system.


12) Improper Authentication (CVE-ID: CVE-2021-1950)

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to improper cleaning of secure memory between authenticated users. A local user can bypass face authentication mechanism.

13) Reachable Assertion (CVE-ID: CVE-2021-30328)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in the NR5G component when validating NR CSI-IM resource configuration. A remote attacker can perform a denial of service (DoS) attack.


14) Reachable Assertion (CVE-ID: CVE-2021-30329)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in NR5G validating TCI configuration. A remote attacker can perform a denial of service (DoS) attack.


15) Reachable Assertion (CVE-ID: CVE-2021-30332)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in NR5G when validating OTA configuration. A remote attacker can perform a denial of service (DoS) attack.


16) Use-after-free (CVE-ID: CVE-2021-35115)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Automotive Multimedia when handling multiple session supported by PVM backend. A remote attacker can pass specially crafted data to the system and execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Remediation

Install update from vendor's website.

References