Improper access control in Qualcomm products - CVE-2021-35070
Published: April 5, 2022 / Updated: April 5, 2022
Vulnerability identifier: #VU61873
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-35070
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in kernel component due to improper SMMU configuration. A local application can gain access to sensitive information.
Affected software
QCM6125
QCS6125
WCD9370
WCD9375
WCN3950
WCN3980
WSA8810
WSA8815
SD665
Google Android
QCS6125
WCD9370
WCD9375
WCN3950
WCN3980
WSA8810
WSA8815
SD665
Google Android
How to mitigate CVE-2021-35070
Install updates from vendor's website.
Google Android - addressed in versions 10 2022-04-05, 11 2022-04-05, 12L 2022-04-05, 12 2022-04-05