Cryptographic issues in Qualcomm products - CVE-2021-35097

Vulnerability identifier: #VU64031

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35097

CWE-ID: CWE-310

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to improper order of signature verification and hashing in the signature verification call. An attacker with physical access can bypass authentication on the system.

WCN3991
WCN3998
WCN3999
WCN6740
WCN6750
WCN6850
WCN6851
WCN6855
WCN6856
WCN7850
WCN7851
WSA8810
WSA8815
WSA8830
WSA8835
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2023-01-05, 11 2023-01-05, 12L 2023-01-05, 12 2023-01-05, 13 2023-01-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2022-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android