Integer overflow in Qualcomm products - CVE-2021-30261
Published: August 3, 2021
Vulnerability identifier: #VU55525
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-30261
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow in WLAN Firmware when handling beacon template update command from HLOS. A local user can run a specially crafted program to trigger heap overflow and execute arbitrary code with elevated privileges.
Affected software
WCD9326
QET4101
QSW8573
Qualcomm215
SD429
SD439
SD632
SDW2500
WCD9306
WCD9330
WCD9335
WCD9340
WCN3610
WCN3615
WCN3620
WCN3660
WCN3660B
WCN3680
WCN3680B
WSA8810
WSA8815
APQ8009W
APQ8016
APQ8037
APQ8052
APQ8056
APQ8076
MSM8108
MSM8208
MSM8209
MSM8608
MSM8952
MSM8956
MSM8976
MSM8976SG
PM8937
QCA1990
QCA4020
QCA9379
SD205
SD210
SD450
QCA6174A
MSM8909W
APQ8017
APQ8053
APQ8009
MSM8917
MSM8920
MSM8937
MSM8940
MSM8953
QET4101
QSW8573
Qualcomm215
SD429
SD439
SD632
SDW2500
WCD9306
WCD9330
WCD9335
WCD9340
WCN3610
WCN3615
WCN3620
WCN3660
WCN3660B
WCN3680
WCN3680B
WSA8810
WSA8815
APQ8009W
APQ8016
APQ8037
APQ8052
APQ8056
APQ8076
MSM8108
MSM8208
MSM8209
MSM8608
MSM8952
MSM8956
MSM8976
MSM8976SG
PM8937
QCA1990
QCA4020
QCA9379
SD205
SD210
SD450
QCA6174A
MSM8909W
APQ8017
APQ8053
APQ8009
MSM8917
MSM8920
MSM8937
MSM8940
MSM8953
How to mitigate CVE-2021-30261
Install updates from vendor's website.