Use-after-free in Qualcomm products - CVE-2021-1940
Published: July 5, 2021
Vulnerability identifier: #VU54540
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1940
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in neural processing when handling firmware responses. A malicious application can trigger a use-after-free error and escalate privileges on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
SD855
SDX55
SD730
SD665
SD675
QCA6574AU
QCS405
SA6155P
WCD9340
WCD9335
SM6250P
SM6250
SDX55M
SDX50M
SDA429W
WCD9341
SD720G
SD678
SD660
SD8CX
SD8C
WCD9370
WCD9375
WCD9380
WCN3610
WCN3620
WCN3660B
WCN3950
WCN3980
WCN3988
WCN3990
WCN3991
WCN3998
WCN3999
WSA8810
WSA8815
QCA6420
QCA6584AU
QCA6574A
QCA6574
QCA6564AU
QCA6564A
QCA6564
QCA6430
QCA6595AU
QCA6391
FSM10056
FSM10055
CSRA6640
CSRA6620
AR8035
AR8031
AQT1000
QCA6696
QCA8337
QCM6125
QCS410
QCS610
QCS6125
SA415M
SA515M
SA6145P
SA6155
SA8155
SA8155P
SA8195P
SDX55
SD730
SD665
SD675
QCA6574AU
QCS405
SA6155P
WCD9340
WCD9335
SM6250P
SM6250
SDX55M
SDX50M
SDA429W
WCD9341
SD720G
SD678
SD660
SD8CX
SD8C
WCD9370
WCD9375
WCD9380
WCN3610
WCN3620
WCN3660B
WCN3950
WCN3980
WCN3988
WCN3990
WCN3991
WCN3998
WCN3999
WSA8810
WSA8815
QCA6420
QCA6584AU
QCA6574A
QCA6574
QCA6564AU
QCA6564A
QCA6564
QCA6430
QCA6595AU
QCA6391
FSM10056
FSM10055
CSRA6640
CSRA6620
AR8035
AR8031
AQT1000
QCA6696
QCA8337
QCM6125
QCS410
QCS610
QCS6125
SA415M
SA515M
SA6145P
SA6155
SA8155
SA8155P
SA8195P
How to mitigate CVE-2021-1940
Install updates from vendor's website.