CVE-2021-1906mediumunder attack

CVE-2021-1906: medium-severity vulnerability in Qualcomm, Inc. Snapdragon Auto, Snapdragon…

Published · Updated

Follow this CVE+ Monitor Snapdragon Mobile+ Monitor Snapdragon Industrial IOT

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.2epss 0.5%
from disclosure to weapon
Published on NVDMay 7
CISA KEV+180d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

When a GPU address fails to be properly removed from memory, the system cannot allocate new GPU addresses correctly. This can cause GPU-related features to stop working or crash on Qualcomm Snapdragon devices.

Technical detail

The vulnerability stems from improper cleanup of GPU address space during deregistration failures in Qualcomm Snapdragon firmware. When address deregistration fails, the memory mapping is not correctly freed, preventing subsequent GPU memory allocation requests from succeeding. This affects multiple Snapdragon platforms and can lead to denial of service of GPU functionality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Qualcomm, Inc. · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Related CVEs — Qualcomm, Inc. Snapdragon Auto, Snapdragon…

In the same product, most dangerous first.

CVE-2020-11261HIGHCVE-2020-11261EPSS 1.6%KEVCVE-2021-1905HIGHCVE-2021-1905EPSS 1.5%KEVCVE-2019-2255—CVE-2019-2255EPSS 1.5%CVE-2019-2256—CVE-2019-2256EPSS 1.5%CVE-2020-11167—CVE-2020-11167EPSS 1.2%CVE-2019-2252—CVE-2019-2252EPSS 1.2%