Type conversion in Qualcomm products - CVE-2021-35091
Published: April 5, 2022
Vulnerability identifier: #VU61881
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-35091
CWE-ID: CWE-704
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a type conversion error in Linux Graphics subsystem when handling page fault for global memory. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
Affected software
SD8Gen15G
WCD9380
WCN6855
WCN6856
WSA8830
WSA8835
Google Android
WCD9380
WCN6855
WCN6856
WSA8830
WSA8835
Google Android
How to mitigate CVE-2021-35091
Install updates from vendor's website.
Google Android - addressed in versions 10 2022-04-05, 11 2022-04-05, 12L 2022-04-05, 12 2022-04-05