Buffer overflow in Qualcomm products - CVE-2021-1909
Published: September 6, 2021
Vulnerability identifier: #VU56343
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1909
CWE-ID: CWE-120
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to lack of length check of parameters passed from trusted applications within the Core component. A local application can trigger a buffer overflow and execute arbitrary code with elevated privileges.
Affected software
QCS6125
Qualcomm215
QSW8573
QSM8350
QSM8250
QRB5165
QFE1952
QFE1922
QFE1100
QCX315
QCS6490
SA415M
QCS610
QCS603
QCS4290
QCS410
QCS2290
QCN9100
QCN9074
SA8195P
SD8CX
SD8C
SD455
SC8280XP
SC8180X+SDX55
QCN9072
SA8155P
SA8155
SA8150P
SA8145P
SA6155
SA6150P
SA6145P
SA515M
QCA9990
QCN5024
QCN5022
QCN5021
QCN3018
QCM6490
QCM6125
QCM4290
QCM2290
QCA9994
QCA9992
QCN5052
QCA9987
QCA9985
QCA9984
QCA9982
QCA9898
QCA9890
QCA9889
QCA9888
QCN6023
QCN9070
QCN9024
QCN9022
QCN9012
QCN9000
QCN7606
QCN6122
QCN6024
SD429
QCN5550
QCN5164
QCN5154
QCN5152
QCN5124
QCN5122
QCN5121
QCN5064
QCN5054
WCD9330
WCN3660
WCN3620
WCN3610
WCD9385
WCD9380
WCD9375
WCD9371
WCD9370
WCD9360
WCD9340
WCN3660A
WCD9306
SM7325
SM7250
SM6250P
SM6250
SM4125
SDXR25G
SDXR1
SDX55M
WCN6750
WTR3925L
WSA8835
WSA8830
WSA8815
WHS9410
WCN6856
WCN6855
WCN6851
WCN6850
WCN6740
WCN3999
WCN3998
WCN3991
WCN3988
WCN3950
WCN3910
WCN3680
WCN3660B
SD7c
SD780G
SD778G
SD768G
SD765G
SD765
SD750G
SD720G
SD820
SD6905G
SD678
SD662
SD632
SD480
SD460
SDA429W
SDX50M
SDX20M
SDX12
SDW2500
SDM830
QCA9887
SD8885G
SD870
SD8655G
SD821
IPQ8068
IPQ8076
IPQ8074A
IPQ8072A
IPQ8072
IPQ8071A
IPQ8071
IPQ8070A
IPQ8070
IPQ8069
IPQ8076A
IPQ8066
IPQ8065
IPQ8062
IPQ6028
IPQ6018
IPQ6010
IPQ6005
IPQ6000
MDM9207
MDM9625M
MDM9625
MDM9330
MDM9250
MDM9235M
MDM9230
MDM9225M
MDM9225
IPQ5028
MDM9205
MDM8635M
MDM8207
IPQ8174
IPQ8173
IPQ8078A
IPQ8078
APQ8064AU
AR9580
AR9380
AR8035
AR8031
AR7420
AR3012
AQT1000
APQ8084
APQ8076
CSR6030
APQ8064
APQ8062
APQ8056
APQ8052
APQ8037
APQ8016
APQ8009W
FSM9915
IPQ5018
IPQ5010
IPQ4029
IPQ4028
IPQ4018
FSM9955
FSM9950
FSM9916
MDM9626
FSM9910
FSM9905
FSM9900
FSM10056
FSM10055
CSRB31024
CSRA6640
CSRA6620
CSR8811
QCA6438
QCA6595AU
QCA6595
QCA6584AU
QCA6584
QCA6574A
QCA6574
QCA6564AU
QCA6564A
QCA6564
QCA6694
QCA6436
QCA6431
QCA6430
QCA6428
QCA6426
QCA6421
QCA6420
QCA6391
QCA6390
QCA9367
QCA9886
QCA9882
QCA9880
QCA9561
QCA9378
QCA6335
QCA8337
QCA8081
QCA8075
QCA8072
QCA7550
QCA7520
QCA7500
QCA6696
QCA6694AU
MSM8209
MSM8952
MSM8916
MSM8608
MSM8956
MSM8208
MSM8108
MDM9655
MDM9645
MDM9635M
MDM9630
MDM9628
QCA4004
QCA6320
QCA6310
QCA6234
QCA6175A
QCA6174
QCA6164
QCA4024
QCA4020
QCA1990
QCA10901
PMP8074
PMD9635
PM8937
MSM8976SG
MSM8976
MSM8962
QCS605
QCS405
SD210
SD205
SD675
SD636
SA6155P
QCA9980
QCN7605
SDX55
SD712
SD730
SD670
SD665
SD450
SDX24
SDX20
SDM630
SDM429W
SD888
SD855
SD850
SD845
SD835
IPQ8074
IPQ8064
MDM9607
MDM9206
MDM9150
APQ8096AU
APQ8053
APQ8017
IPQ4019
QCA6574AU
QCA9558
QCA9531
QCA9379
QCA9377
MSM8953
MSM8940
MSM8937
MSM8920
MSM8917
MSM8909W
MDM9650
MDM9640
QCA6174A
APQ8009
MSM8996AU
Google Android
Qualcomm215
QSW8573
QSM8350
QSM8250
QRB5165
QFE1952
QFE1922
QFE1100
QCX315
QCS6490
SA415M
QCS610
QCS603
QCS4290
QCS410
QCS2290
QCN9100
QCN9074
SA8195P
SD8CX
SD8C
SD455
SC8280XP
SC8180X+SDX55
QCN9072
SA8155P
SA8155
SA8150P
SA8145P
SA6155
SA6150P
SA6145P
SA515M
QCA9990
QCN5024
QCN5022
QCN5021
QCN3018
QCM6490
QCM6125
QCM4290
QCM2290
QCA9994
QCA9992
QCN5052
QCA9987
QCA9985
QCA9984
QCA9982
QCA9898
QCA9890
QCA9889
QCA9888
QCN6023
QCN9070
QCN9024
QCN9022
QCN9012
QCN9000
QCN7606
QCN6122
QCN6024
SD429
QCN5550
QCN5164
QCN5154
QCN5152
QCN5124
QCN5122
QCN5121
QCN5064
QCN5054
WCD9330
WCN3660
WCN3620
WCN3610
WCD9385
WCD9380
WCD9375
WCD9371
WCD9370
WCD9360
WCD9340
WCN3660A
WCD9306
SM7325
SM7250
SM6250P
SM6250
SM4125
SDXR25G
SDXR1
SDX55M
WCN6750
WTR3925L
WSA8835
WSA8830
WSA8815
WHS9410
WCN6856
WCN6855
WCN6851
WCN6850
WCN6740
WCN3999
WCN3998
WCN3991
WCN3988
WCN3950
WCN3910
WCN3680
WCN3660B
SD7c
SD780G
SD778G
SD768G
SD765G
SD765
SD750G
SD720G
SD820
SD6905G
SD678
SD662
SD632
SD480
SD460
SDA429W
SDX50M
SDX20M
SDX12
SDW2500
SDM830
QCA9887
SD8885G
SD870
SD8655G
SD821
IPQ8068
IPQ8076
IPQ8074A
IPQ8072A
IPQ8072
IPQ8071A
IPQ8071
IPQ8070A
IPQ8070
IPQ8069
IPQ8076A
IPQ8066
IPQ8065
IPQ8062
IPQ6028
IPQ6018
IPQ6010
IPQ6005
IPQ6000
MDM9207
MDM9625M
MDM9625
MDM9330
MDM9250
MDM9235M
MDM9230
MDM9225M
MDM9225
IPQ5028
MDM9205
MDM8635M
MDM8207
IPQ8174
IPQ8173
IPQ8078A
IPQ8078
APQ8064AU
AR9580
AR9380
AR8035
AR8031
AR7420
AR3012
AQT1000
APQ8084
APQ8076
CSR6030
APQ8064
APQ8062
APQ8056
APQ8052
APQ8037
APQ8016
APQ8009W
FSM9915
IPQ5018
IPQ5010
IPQ4029
IPQ4028
IPQ4018
FSM9955
FSM9950
FSM9916
MDM9626
FSM9910
FSM9905
FSM9900
FSM10056
FSM10055
CSRB31024
CSRA6640
CSRA6620
CSR8811
QCA6438
QCA6595AU
QCA6595
QCA6584AU
QCA6584
QCA6574A
QCA6574
QCA6564AU
QCA6564A
QCA6564
QCA6694
QCA6436
QCA6431
QCA6430
QCA6428
QCA6426
QCA6421
QCA6420
QCA6391
QCA6390
QCA9367
QCA9886
QCA9882
QCA9880
QCA9561
QCA9378
QCA6335
QCA8337
QCA8081
QCA8075
QCA8072
QCA7550
QCA7520
QCA7500
QCA6696
QCA6694AU
MSM8209
MSM8952
MSM8916
MSM8608
MSM8956
MSM8208
MSM8108
MDM9655
MDM9645
MDM9635M
MDM9630
MDM9628
QCA4004
QCA6320
QCA6310
QCA6234
QCA6175A
QCA6174
QCA6164
QCA4024
QCA4020
QCA1990
QCA10901
PMP8074
PMD9635
PM8937
MSM8976SG
MSM8976
MSM8962
QCS605
QCS405
SD210
SD205
SD675
SD636
SA6155P
QCA9980
QCN7605
SDX55
SD712
SD730
SD670
SD665
SD450
SDX24
SDX20
SDM630
SDM429W
SD888
SD855
SD850
SD845
SD835
IPQ8074
IPQ8064
MDM9607
MDM9206
MDM9150
APQ8096AU
APQ8053
APQ8017
IPQ4019
QCA6574AU
QCA9558
QCA9531
QCA9379
QCA9377
MSM8953
MSM8940
MSM8937
MSM8920
MSM8917
MSM8909W
MDM9650
MDM9640
QCA6174A
APQ8009
MSM8996AU
Google Android
How to mitigate CVE-2021-1909
Install updates from vendor's website.
Google Android - addressed in versions 8.1 2021-09-05, 9 2021-09-05, 10 2021-09-05, 11 2021-09-05