Improper Validation of Array Index in Qualcomm products - CVE-2021-35126
Published: April 4, 2022
Vulnerability identifier: #VU61844
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-35126
CWE-ID: CWE-129
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Qualcomm
Affected software:
QAM8295P
QCA6391
QCA6696
QCM6490
QCS6490
SA8295P
SD8Gen15G
SD8cxGen3
SD778G
SD780G
SD8885G
SM7315
SM7325P
WCD9370
WCD9375
WCD9380
WCD9385
WCN6740
WCN6750
WCN6850
WCN6851
WCN6855
WCN6856
WSA8830
WSA8835
SD888
QAM8295P
QCA6391
QCA6696
QCM6490
QCS6490
SA8295P
SD8Gen15G
SD8cxGen3
SD778G
SD780G
SD8885G
SM7315
SM7325P
WCD9370
WCD9375
WCD9380
WCD9385
WCN6740
WCN6750
WCN6850
WCN6851
WCN6855
WCN6856
WSA8830
WSA8835
SD888
Detailed vulnerability description
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper validation of array index within the DSP Service. A malicious application can trigger a boundary error and execute arbitrary code with elevated privileges.
How to mitigate CVE-2021-35126
Install updates from vendor's website.