PT-2021-9285 · Qualcomm · Snapdragon Mobile+2

Published 2021-02-22 · Updated 2021-07-21 · CVE-2020-11277

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile (affected versions not specified)

Description A potential issue exists due to a possible race condition during an async fastrpc session. This occurs after sending an RPC message, as the fastrpc context may be freed during the async session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

CVE-2020-11277

Affected Products

Snapdragon Compute

Snapdragon Industrial Iot

Snapdragon Mobile

References · 2

• https://qualcomm.com/company/product-security/bulletins/february-2021-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11277 · Security Note