Use-after-free in Qualcomm products - CVE-2021-35133

Vulnerability identifier: #VU64978

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35133

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the synx driver. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.

WCN6850
WCD9370
WCD9375
WCD9380
WCD9385
WCN3988
WCN3991
WCN6740
WCN6750
WCD9341
WCN6851
WCN6855
WCN6856
WCN7850
WCN7851
WSA8830
WSA8835
SD480
QCA6391
QCA8081
QCA8337
QCM6490
QCS6490
SD 8 Gen1 5G
AR8035
SD780G
SD888 5G
SDX12
SDX65
WCD9335
Pixel
WSA8832
QCA6174A
QCA9377
SM7450
SM8475
SM8475P

Install updates from vendor's website.

Pixel - update to 12L 2022-07-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2022-bulletin.html
• https://source.codeaurora.org/quic/la/kernel/msm-5.4/commit/?id=f0c81db62df752bd9004df796212e13ee75bd933

• Multiple vulnerabilities in Qualcomm chipsets
• Privilege escalation in Google Pixel