Improper Validation of Array Index in Qualcomm products - CVE-2021-1933

Vulnerability identifier: #VU56341

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1933

CWE-ID: CWE-129

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of invite message with SDP body within the Data Modem component. A remote attacker can send specially crafted data to the system, trigger memory corruption and execute arbitrary code on the system.

SD855
SDX55
SDX24
SDM630
SDM429W
SD850
SD845
SD730
SD712
SD670
SD665
SD450
QCA6574AU
QCA9377
QCA6174A
MSM8953
MSM8940
MSM8920
MSM8917
APQ8053
SD675
SD636
APQ8017
QCS605
SM6250
SDXR1
SDX55M
SDX50M
SDA429W
SM6250P
SD720G
SD678
SD632
WCN3660B
WSA8815
WHS9410
WCN6850
WCN3998
WCN3991
WCN3988
WCN3950
WCN3910
WCN3680
WCN3660
WCN3620
WCN3610
WCD9380
WCD9375
WCD9371
WCD9370
WCD9360
WCD9340
QCA6335
QCA6696
QCA6595AU
QCA6584AU
QCA6574A
QCA6564AU
QCA6430
QCA6420
QCA6390
QCA6310
CSRB31024
AQT1000
SA415M
SD429
SD8CX
SD8C
SD455
SC8180X+SDX55
SA8155P
SA8155
Qualcomm215
QCS6125
QCS610
QCS603
QCS4290
QCS410
QCM6125
QCM4290
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 8.1 2021-09-05, 9 2021-09-05, 10 2021-09-05, 11 2021-09-05

• https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android