Time-of-check Time-of-use (TOCTOU) Race Condition in Qualcomm products - CVE-2021-30342

Vulnerability identifier: #VU61840

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-30342

CWE-ID: CWE-367

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition in LTE component between PDCP and RRC tasks when processing RRC Command packets. A remote attacker can send specially crafted packets to the device and execute arbitrary code on the system.

SD660
SDA429W
SD7c
SD720G
SD680
SD678
SD662
SDW2500
SD460
SD439
SD429
SD8cxGen2
SA8195P
SA8155P
SA8150P
SA8145P
WCD9370
WSA8835
WSA8830
WCN3998
WCN3991
WCN3988
WCN3950
WCN3910
WCN3620
WCN3610
WCD9380
WCD9375
WCD9330
WCD9306
SW5100P
SW5100
SM6250P
SM6250
SDXR1
SDX12
MDM9250
QCA6430
QCA6420
QCA4004
MDM9655
MDM9628
QCA6564A
MDM9207
MDM9205
MDM8207
FSM10056
FSM10055
CSRB31024
AQT1000
QCM2290
SA6150P
SA6145P
SA415M
QSW8573
QCS6125
QCS610
QCS4290
QCS410
QCS2290
QCM6125
QCM4290
APQ8009W
QCA9367
QCA6696
QCA6595AU
QCA6584AU
QCA6584
QCA6574A
QCA6574
QCA6564AU
SDM429W
SD855
SD850
SD730
SD665
SD210
SD205
SD675
SA6155P
SDX24
SDX20
QCA6174A
MSM8996AU
MSM8909W
MDM9650
MDM9640
MDM9607
MDM9206
MDM9150
APQ8096AU
APQ8017
QCA9377
QCA6574AU
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-04-05, 11 2022-04-05, 12L 2022-04-05, 12 2022-04-05

• https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android