PT-2020-6443 · Qualcomm · Qualcomm Snapdragon Auto+7

Published 2020-11-17 · Updated 2025-04-02 · CVE-2021-1905

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto (affected versions not specified) Qualcomm Snapdragon Compute (affected versions not specified) Qualcomm Snapdragon Connectivity (affected versions not specified) Qualcomm Snapdragon Consumer IOT (affected versions not specified) Qualcomm Snapdragon Industrial IOT (affected versions not specified) Qualcomm Snapdragon Mobile (affected versions not specified) Qualcomm Snapdragon Voice & Music (affected versions not specified) Qualcomm Snapdragon Wearables (affected versions not specified)

Description The issue is related to a possible use after free due to improper handling of memory mapping of multiple processes simultaneously. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Qualcomm Snapdragon Auto, consider disabling the vulnerable memory mapping functionality until a patch is available. For Qualcomm Snapdragon Compute, restrict access to the affected memory areas to minimize the risk of exploitation. For Qualcomm Snapdragon Connectivity, avoid using the vulnerable memory mapping feature in multiple processes simultaneously until the issue is resolved. For Qualcomm Snapdragon Consumer IOT, temporarily disable the memory mapping function to prevent potential attacks. For Qualcomm Snapdragon Industrial IOT, restrict the use of the vulnerable memory mapping module to minimize the risk of exploitation. For Qualcomm Snapdragon Mobile, consider applying configuration changes to prevent the improper handling of memory mapping. For Qualcomm Snapdragon Voice & Music, avoid using the vulnerable memory mapping feature in multiple processes simultaneously until the issue is resolved. For Qualcomm Snapdragon Wearables, restrict access to the affected memory areas to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-04807

CVE-2021-1905

Affected Products

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

Qualcomm Snapdragon Wearables

References · 9

• https://qualcomm.com/company/product-security/bulletins/may-2021-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1905 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1905 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/109063 · Telegram Post
• https://t.me/cvenotify/117405 · Telegram Post
• https://t.me/cvenotify/14233 · Telegram Post
• https://safe.cnews.ru/news/top/2021-05-21vandroidzakryli4dyrykotorye · Note