CVE-2021-1940

CVE Database · CVE-2021-1940

CVE-2021-1940

· HIGHModified

CVSS v3.1

8.4

EPSS

0.18%

Published

Jul 13, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-416

Affected Products (134)

qualcomm · aqt1000_firmwarevulnerable

qualcomm · aqt1000

qualcomm · ar8031_firmwarevulnerable

qualcomm · ar8031

qualcomm · ar8035_firmwarevulnerable

qualcomm · ar8035

qualcomm · csra6620_firmwarevulnerable

qualcomm · csra6620

qualcomm · csra6640_firmwarevulnerable

qualcomm · csra6640

qualcomm · fsm10055_firmwarevulnerable

· fsm10055

References (4)

http://packetstormsecurity.com/files/172856/Qualcomm-NPU-Use-After-Free-Information-Leak.html

https://www.qualcomm.com/company/product-security/bulletins/july-2021-bulletin

PatchVendor Advisory

http://packetstormsecurity.com/files/172856/Qualcomm-NPU-Use-After-Free-Information-Leak.html

https://www.qualcomm.com/company/product-security/bulletins/july-2021-bulletin

PatchVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs