PT-2022-9953 · Qualcomm · Snapdragon Mobile+5
Peterpark
·
Published
2022-01-03
·
Updated
2022-01-11
·
CVE-2021-30267
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Snapdragon Auto (affected versions not specified)
Snapdragon Compute (affected versions not specified)
Snapdragon Connectivity (affected versions not specified)
Snapdragon Consumer IOT (affected versions not specified)
Snapdragon Industrial IOT (affected versions not specified)
Snapdragon Mobile (affected versions not specified)
Description
The issue is related to possible integer overflow to buffer overflow due to improper input validation in FTM ARA commands. This affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, and Mobile.
Recommendations
For Snapdragon Auto, update to a version that includes proper input validation for FTM ARA commands.
For Snapdragon Compute, update to a version that includes proper input validation for FTM ARA commands.
For Snapdragon Connectivity, update to a version that includes proper input validation for FTM ARA commands.
For Snapdragon Consumer IOT, update to a version that includes proper input validation for FTM ARA commands.
For Snapdragon Industrial IOT, update to a version that includes proper input validation for FTM ARA commands.
For Snapdragon Mobile, update to a version that includes proper input validation for FTM ARA commands.
As a temporary workaround, consider disabling the use of FTM ARA commands until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the vulnerable
FTM ARA commands in the affected products until the issue is resolved.Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Snapdragon Auto
Snapdragon Compute
Snapdragon Connectivity
Snapdragon Consumer Iot
Snapdragon Industrial Iot
Snapdragon Mobile