PT-2021-13680 · Qualcomm · Snapdragon Connectivity+6

Christopher Wade · Published 2021-07-13 · Updated 2025-06-21 · CVE-2021-1931

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto versions prior to the fixed version Snapdragon Compute versions prior to the fixed version Snapdragon Connectivity versions prior to the fixed version Snapdragon Consumer IOT versions prior to the fixed version Snapdragon Industrial IOT versions prior to the fixed version Snapdragon Mobile versions prior to the fixed version Snapdragon Voice & Music versions prior to the fixed version

Description: The issue is related to a possible buffer overflow due to improper validation of buffer length while processing fast boot commands. This affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music. There have been reports of this issue being exploited to unlock the bootloader on certain devices, such as the Quest 2.

Recommendations: For Snapdragon Auto, update to a version that includes the fix for this issue. For Snapdragon Compute, update to a version that includes the fix for this issue. For Snapdragon Connectivity, update to a version that includes the fix for this issue. For Snapdragon Consumer IOT, update to a version that includes the fix for this issue. For Snapdragon Industrial IOT, update to a version that includes the fix for this issue. For Snapdragon Mobile, update to a version that includes the fix for this issue. For Snapdragon Voice & Music, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the fast boot command processing until a patch is available. Restrict access to the fast boot functionality to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-1931

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1931 · Security Note
• https://qualcomm.com/company/product-security/bulletins/july-2021-bulletin · Vendor Advisory
• https://twitter.com/d4rknight1050/status/1753565954250789016 · Twitter Post
• https://twitter.com/VAmusin67377/status/1915164397389177345 · Twitter Post
• https://t.me/cvenotify/17491 · Telegram Post
• https://twitter.com/sub_arale/status/1936351831694995949 · Twitter Post