PT-2021-5583 · Qualcomm · Snapdragon Connectivity+7

Published 2021-11-01 · Updated 2021-11-16 · CVE-2021-1975

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables (affected versions not specified)

Description The issue is related to a possible heap overflow due to an improper length check of the domain while parsing the DNS response. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00013

CVE-2021-1975

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Iot

Snapdragon Voice & Music

Snapdragon Wearables

References · 7

• https://qualcomm.com/company/product-security/bulletins/november-2021-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1975 · Security Note
• https://bdu.fstec.ru/vul/2022-00013 · Security Note
• https://t.me/cvenotify/23317 · Telegram Post
• https://t.me/nekaspersky/1415 · Telegram Post
• https://t.me/cibsecurity/32284 · Telegram Post
• http://qualcomm.com/company/product-security/bulletins/november-2021-bulletin · Note