PT-2021-5159 · Qualcomm · Snapdragon Auto+5

Published 2021-11-01 · Updated 2021-11-16 · CVE-2021-1981

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (affected versions not specified)

Description The issue is related to a possible buffer over read due to an improper IE size check of the Bearer capability IE in an MT setup request from the network. This could allow a remote attacker to cause a denial of service. The vulnerability is associated with a buffer over read in the memory of Qualcomm's embedded software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-05959

CVE-2021-1981

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1981 · Security Note
• https://qualcomm.com/company/product-security/bulletins/november-2021-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05959 · Security Note
• https://t.me/cibsecurity/32286 · Telegram Post
• https://t.me/cvenotify/23315 · Telegram Post
• http://qualcomm.com/company/product-security/bulletins/november-2021-bulletin · Note