Improper access control in Qualcomm products - CVE-2021-30346

Vulnerability identifier: #VU61865

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-30346

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper SMMU configuration, which results in RPM secure Stream  accessing any secure resource. A local application can gain access to sensitive information.

WCD9370
WSA8835
WSA8830
WSA8815
WSA8810
WCN3999
WCN3998
WCN3991
WCN3988
WCN3980
WCN3950
WCN3910
WCD9385
WCD9375
AR8035
SW5100P
SW5100
SM6375
SD680
SD662
SD480
SD460
QCS4290
QCS2290
QCM4290
QCM2290
QCA9984
QCS405
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-04-05, 11 2022-04-05, 12L 2022-04-05, 12 2022-04-05

• https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android