Improper Validation of Array Index in Qualcomm products - CVE-2021-35072

Vulnerability identifier: #VU63089

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35072

CWE-ID: CWE-129

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in RFA component when processing external DIAG command. A local application can trigger buffer overflow and execute arbitrary code with elevated privileges.

SD835
SDM429W
SD450
SD210
MSM8937
MSM8920
MSM8917
MSM8909W
MDM9650
MDM9640
MSM8940
MDM9607
MDM9206
MDM9150
APQ8096AU
APQ8053
APQ8017
QCA6574AU
QCA9379
QCA9377
APQ8009
QCA6174A
MSM8996AU
MSM8953
WCD9340
WCD9335
WCD9330
WCD9326
SW5100P
SW5100
SM4125
SDX12
SDW2500
WCD9341
SD821
SD820
SD680
SD662
SD632
SD460
SD439
SD429
WCN3910
WSA8835
WSA8830
WSA8815
WSA8810
WCN3998
WCN3990
WCN3988
WCN3980
WCN3950
WCN3680B
WCN3680
WCN3660B
WCN3660
WCN3620
WCN3615
WCN3610
WCD9375
WCD9370
MDM9628
MSM8608
MSM8209
MSM8208
MSM8108
MDM9250
APQ8037
APQ8009W
Qualcomm215
QCS4290
QCS2290
QCM4290
QCM2290
QCA9367
QCA6584
QCA6574A
QCA6574
QCA6564AU
QCA6564A
QCA6320
QCA6310

Install updates from vendor's website.

• https://docs.qualcomm.com/bundle/publicresource/HD-10000-1/topics/may-2022-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets