Time-of-check Time-of-use (TOCTOU) Race Condition in Qualcomm products - CVE-2021-35111

Vulnerability identifier: #VU64043

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35111

CWE-ID: CWE-367

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of tag id while RRC sending tag id to MAC within Modem. A remote attacker can perform a denial of service attack.

WCN6851
WCD9341
WCD9370
WCD9375
WCD9380
WCD9385
WCN3991
WCN3998
WCN6750
WCN6850
WCN6855
WCN6856
WCN7851
WSA8810
WSA8815
WSA8830
WSA8835
SD865 5G
QCA6390
QCA6391
QCA8081
QCA8337
SD 8 Gen1 5G
SD765
SD765G
SD768G
SD778G
AR8035
SD870
SD888 5G
SDX55M
SDX65
SM7250P
SM8475P
WSA8832
SDX55
SM7450
SM8475
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-06-05, 11 2022-06-05, 12L 2022-06-05, 12 2022-06-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2022-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android