PT-2021-13693 · Qualcomm · Snapdragon Connectivity+5

Published 2021-09-09 · Updated 2021-09-22 · CVE-2021-1946

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto (affected versions not specified) Snapdragon Compute (affected versions not specified) Snapdragon Connectivity (affected versions not specified) Snapdragon Consumer IOT (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon Mobile (affected versions not specified)

Description: A Null Pointer Dereference may occur due to improper validation while processing crafted SDP body. This issue affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, and Mobile.

Recommendations: For Snapdragon Auto, update to a version that includes the fix for this issue. For Snapdragon Compute, update to a version that includes the fix for this issue. For Snapdragon Connectivity, update to a version that includes the fix for this issue. For Snapdragon Consumer IOT, update to a version that includes the fix for this issue. For Snapdragon Industrial IOT, update to a version that includes the fix for this issue. For Snapdragon Mobile, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the processing of crafted SDP bodies until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-1946

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-1946 · Security Note
• https://qualcomm.com/company/product-security/bulletins/september-2021-bulletin · Vendor Advisory
• https://t.me/cvenotify/21308 · Telegram Post
• https://t.me/cibsecurity/28555 · Telegram Post