SB2021070507 - Multiple vulnerabilities in Qualcomm chipsets

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021070507

SB2021070507 - Multiple vulnerabilities in Qualcomm chipsets

Published: July 5, 2021 Updated: May 9, 2025

Security Bulletin ID SB2021070507
Severity
High
Patch available
YES
Number of vulnerabilities 23
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 43% Low 48%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 23 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2021-1965)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to lack of parameter length check during MBSSID scan IE parse in WLAN Host Communication. A remote attacker can send specially crafted traffic to the device, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Out-of-bounds read (CVE-ID: CVE-2021-1899)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition caused by lack of length check while flashing meta images in the Boot subsystem. An attacker with physical access to device can perform a denial of service attack.

3) Out-of-bounds read (CVE-ID: CVE-2021-1898)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition caused by incorrect overflow check when loading splash image in the Boot subsystem. An attacker with physical access to device can perform a denial of service attack.

4) Reachable Assertion (CVE-ID: CVE-2021-1907)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion caused by lack of length check in BA request in WLAN HOST. A remote attacker can send specially crafted traffic to the device and perform a denial of service attack.


5) Buffer overflow (CVE-ID: CVE-2021-1890)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error caused by improper length check of public exponent in RSA import key function in HLOS. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.


6) Buffer overflow (CVE-ID: CVE-2021-1889)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Trusted Application component in HLOS. A malicious application can trigger memory corruption and execute arbitrary code with elevated privileges.


7) Double Free (CVE-ID: CVE-2021-1888)

The vulnerability allows a malicious application to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Trusted Application implementation in HLOS. A malicious application can pass specially crafted data to the system, trigger double free error and execute arbitrary code with elevated privileges.



8) Untrusted Pointer Dereference (CVE-ID: CVE-2021-1886)

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to untrusted pointer dereference within the in Key Management component in HLOS. A malicious application can trigger memory corruption and execute arbitrary code with elevated privileges.


9) Integer overflow (CVE-ID: CVE-2020-11307)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Data HLOS component. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


10) Insecure configuration (CVE-ID: CVE-2021-1896)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to weak configuration in WLAN, which can cause forwarding of unencrypted packets from one client to another. A remote attacker on the local network can intercept traffic and gain access to sensitive information.


11) Out-of-bounds read (CVE-ID: CVE-2021-1901)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition caused by lack of length check while flashing meta images in the Boot subsystem. An attacker with physical access to device can perform a denial of service attack.

12) Out-of-bounds read (CVE-ID: CVE-2021-1897)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition caused by lack of validation of boundary checks when loading splash image in the Boot subsystem. An attacker with physical access to device can perform a denial of service attack.


13) Out-of-bounds read (CVE-ID: CVE-2021-1970)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing FT sub-elements in WLAN HOST. A remote attacker can send specially crafted traffic to the device, trigger out-of-bounds read error and read contents of memory on the system.


14) Out-of-bounds read (CVE-ID: CVE-2021-1964)

The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due to a boundary condition caused by improper validation of IE size while parsing beacon from peer device in WLAN Host Communication subsystem. A remote attacker can send specially crafted traffic to the device, trigger an out-of-bounds read error and perform a denial of service attack.


15) Out-of-bounds read (CVE-ID: CVE-2021-1954)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary condition caused by improper validation of data pointer while parsing FILS indication IE in WLAN Host Communication subsystem. A remote attacker can send specially crafted traffic to the device, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.


16) Out-of-bounds read (CVE-ID: CVE-2021-1945)

The vulnerability allows a remote attacker to perform a denial of service attack

The vulnerability exists due to a boundary condition caused by lack of length check of Bandwidth-NSS IE in WLAN Host Communication system. A remote attacker can send specially crafted traffic to the device, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.


17) Out-of-bounds read (CVE-ID: CVE-2021-1943)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition caused by the improper validation of TBTT count and length while parsing the beacon response in WLAN Host Communication component. A remote attacker can send specially crafted traffic to the device, trigger out-of-bounds read error and perform a denial of service attack.


18) Use-after-free (CVE-ID: CVE-2021-1940)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in neural processing when handling firmware responses. A malicious application can trigger a use-after-free error and escalate privileges on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


19) Reachable Assertion (CVE-ID: CVE-2021-1955)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in SAP case due to improper handling of connections when association is rejected. A remote attacker can send specially crafted traffic to the device and perform a denial of service attack.


20) Reachable Assertion (CVE-ID: CVE-2021-1953)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion caused by improper handling of received malformed FTMR request frame while responding with FTM1 frame. A remote attacker can send specially crafted traffic to the device and perform DoS attack.


21) Reachable Assertion (CVE-ID: CVE-2021-1938)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion while creating and deleting the peer in WLAN Firmware. A remote attacker can send specially crafted traffic to the device and perform a denial of service attack.


22) Buffer overflow (CVE-ID: CVE-2021-1931)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper validation of buffer length while processing fast boot commands. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.


23) Reachable Assertion (CVE-ID: CVE-2021-1887)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in the WLAN subsystem while using the Wi-Fi Fine Timing Measurement protocol. A remote attacker can send specially crafted traffic to the device and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References