CVE-2021-1905highunder attackCWE-416

CVE-2021-1905: high-severity vulnerability in Qualcomm, Inc. Snapdragon Auto, Snapdragon…

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.4epss 1.5%
from disclosure to weapon16 days
Published on NVDMay 7
1st PoC+16d
CISA KEV+180d
exploitation probability
1.5%top 25% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A memory management flaw in Snapdragon processors allows attackers to access or corrupt memory that has already been freed, potentially causing system crashes or enabling unauthorized code execution. This occurs when multiple processes try to access the same memory location simultaneously.

Technical detail

Use-after-free vulnerability in Snapdragon kernel memory mapping during concurrent multi-process operations (CWE-416). Attack vector requires local access to trigger improper synchronization of memory deallocation, potentially enabling arbitrary code execution with elevated privileges or denial of service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Qualcomm, Inc. · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
public PoCs found — 2
githubgithub.com/TAKIANFIF/CVE-2021-1905-CVE-2021-1906-CVE-2021-28663-CVE-2021-28664★ 0vulncheckvulncheck.com/xdb/fbd82b92a70aunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Qualcomm, Inc. Snapdragon Auto, Snapdragon…

In the same product, most dangerous first.

CVE-2020-11261HIGHCVE-2020-11261EPSS 1.6%KEVCVE-2021-1906MEDIUMCVE-2021-1906EPSS 0.5%KEVCVE-2019-2256—CVE-2019-2256EPSS 1.5%CVE-2019-2255—CVE-2019-2255EPSS 1.5%CVE-2020-11167—CVE-2020-11167EPSS 1.2%CVE-2019-2252—CVE-2019-2252EPSS 1.2%
References
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1905https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin