Improper Authentication in Qualcomm products - CVE-2021-1950

Vulnerability identifier: #VU61071

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1950

CWE-ID: CWE-287

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to improper cleaning of secure memory between authenticated users. A local user can bypass face authentication mechanism.

SD768G
SM7250P
SM6375
SM6225
SDXR25G
SDX57M
SDX55M
SD8885G
SD870
SD8655G
SD778G
SM7325P
SD765G
SD765
SD750G
SD6905G
SD662
SD480
SD460
SA8195P
WCN3991
WSA8835
WSA8830
WSA8815
WSA8810
WCN6856
WCN6855
WCN6851
WCN6850
WCN6750
WCN3999
WCN3998
SA8155P
WCN3988
WCN3980
WCN3950
WCN3910
WCD9385
WCD9380
WCD9375
WCD9370
WCD9341
SXR2150P
QCA6436
QCN5022
QCN5021
QCM6490
QCM4290
QCM2290
QCA9984
QCA8081
QCA8075
QCA8072
QCA6696
QCN5052
QCA6426
QCA6391
QCA6390
QCA4024
IPQ6028
IPQ6018
IPQ6010
IPQ6005
IPQ6000
CSR8811
QCN9074
SA8150P
SA8145P
SA6150P
SA6145P
QSM8250
QCS6490
QCS610
QCS4290
QCS2290
AR8035
QCN9072
QCN9070
QCN9024
QCN9022
QCN9000
QCN6024
QCN6023
QCN5152
QCN5122
QCN5121
SDX55
SA9000P
SA8540P
QCA6574AU
SA6155P
QCS405
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-03-05, 11 2022-03-05, 12 2022-03-05

• https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android