PT-2022-10396 · Qualcomm · Snapdragon Industrial Iot+3

Published 2022-02-11 · Updated 2023-04-19 · CVE-2021-35075

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snapdragon Auto (affected versions not specified) Snapdragon Connectivity (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon Mobile (affected versions not specified)

Description The issue is related to a possible null pointer dereference due to lack of WDOG structure validation during registration. This affects various Snapdragon products, including Auto, Connectivity, Industrial IOT, and Mobile.

Recommendations For Snapdragon Auto, update to a version that includes proper WDOG structure validation. For Snapdragon Connectivity, update to a version that includes proper WDOG structure validation. For Snapdragon Industrial IOT, update to a version that includes proper WDOG structure validation. For Snapdragon Mobile, update to a version that includes proper WDOG structure validation. As a temporary workaround, consider disabling the registration functionality that involves WDOG structure validation until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-35075

Affected Products

Snapdragon Auto

Snapdragon Connectivity

Snapdragon Industrial Iot

Snapdragon Mobile

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-35075 · Security Note
• https://qualcomm.com/company/product-security/bulletins/february-2022-bulletin · Vendor Advisory
• https://t.me/cibsecurity/37280 · Telegram Post
• https://t.me/cvenotify/26640 · Telegram Post