PT-2021-18691 · Qualcomm · Snapdragon Industrial Iot+3

Published 2021-11-12 · Updated 2021-11-16 · CVE-2021-30263

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snapdragon Compute (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon Mobile (affected versions not specified) Snapdragon Voice & Music (affected versions not specified)

Description A possible race condition can occur due to the lack of a synchronization mechanism when the On-Device Logging node is opened twice concurrently. This issue affects various Snapdragon products, including Compute, Industrial IOT, Mobile, and Voice & Music.

Recommendations For Snapdragon Compute, consider implementing a synchronization mechanism to prevent concurrent access to the On-Device Logging node. For Snapdragon Industrial IOT, restrict concurrent openings of the On-Device Logging node until a proper synchronization mechanism is implemented. For Snapdragon Mobile, as a temporary workaround, consider disabling the On-Device Logging node when not in use to minimize the risk of exploitation. For Snapdragon Voice & Music, avoid opening the On-Device Logging node concurrently to prevent potential race conditions. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-30263

Affected Products

Snapdragon Compute

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

References · 4

• https://qualcomm.com/company/product-security/bulletins/november-2021-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30263 · Security Note
• https://t.me/cvenotify/23310 · Telegram Post
• https://t.me/cibsecurity/32276 · Telegram Post