Vulnerability identifier: #VU61879

Vulnerability risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35123

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
AQT1000
Mobile applications / Mobile firmware & hardware
QCA6390
Mobile applications / Mobile firmware & hardware
QCA6391
Mobile applications / Mobile firmware & hardware
SD8Gen15G
Mobile applications / Mobile firmware & hardware
SD480
Mobile applications / Mobile firmware & hardware
SD660
Mobile applications / Mobile firmware & hardware
SD778G
Mobile applications / Mobile firmware & hardware
SD780G
Mobile applications / Mobile firmware & hardware
SD8655G
Mobile applications / Mobile firmware & hardware
SD870
Mobile applications / Mobile firmware & hardware
SD8885G
Mobile applications / Mobile firmware & hardware
SDX55M
Mobile applications / Mobile firmware & hardware
SM6375
Mobile applications / Mobile firmware & hardware
SM7325P
Mobile applications / Mobile firmware & hardware
WCD9335
Mobile applications / Mobile firmware & hardware
WCD9370
Mobile applications / Mobile firmware & hardware
WCD9375
Mobile applications / Mobile firmware & hardware
WCD9380
Mobile applications / Mobile firmware & hardware
WCD9385
Mobile applications / Mobile firmware & hardware
WCN3980
Mobile applications / Mobile firmware & hardware
WCN3988
Mobile applications / Mobile firmware & hardware
WCN3991
Mobile applications / Mobile firmware & hardware
WCN3998
Mobile applications / Mobile firmware & hardware
WCN6740
Mobile applications / Mobile firmware & hardware
WCN6750
Mobile applications / Mobile firmware & hardware
WCN6850
Mobile applications / Mobile firmware & hardware
WCN6851
Mobile applications / Mobile firmware & hardware
WCN6855
Mobile applications / Mobile firmware & hardware
WCN6856
Mobile applications / Mobile firmware & hardware
WSA8830
Mobile applications / Mobile firmware & hardware
WSA8835
Mobile applications / Mobile firmware & hardware
SD855
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary within the Bluetooth HOST component when processing GATT multi notifications. An attacker with physical access to device can send specially crafted packets to the device, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

AQT1000: All versions

QCA6390: All versions

QCA6391: All versions

SD8Gen15G: All versions

SD480: All versions

SD660: All versions

SD778G: All versions

SD780G: All versions

SD855: All versions

SD8655G: All versions

SD870: All versions

SD8885G: All versions

SDX55M: All versions

SM6375: All versions

SM7325P: All versions

WCD9335: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3980: All versions

WCN3988: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WSA8830: All versions

WSA8835: All versions

---

External links
http://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
http://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/system/bt/commit/?id=2ea716990f7978683deb30eb6b791205d1206c59

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.