CVE-2021-1891 Use after free in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

High 8.4 Published 7 May 2021 Updated 3 Aug 2024

A use-after-free in the audio driver allows attackers to execute arbitrary code or escalate privileges on Qualcomm Snapdragon devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-1891?

CVE-2021-1891 is a high-severity use after free vulnerability in Qualcomm Apq8009w Firmware, published on 7 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Weakness: CWE-416

Which versions are affected by CVE-2021-1891?

It affects 414 products.

Products include Qualcomm Apq8009w Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8053 Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware and 408 more.

How do I fix CVE-2021-1891?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-1891 being exploited?

There is no known exploitation of CVE-2021-1891 in the wild and no public exploit code.

All Qualcomm Apq8009w Firmware vulnerabilities

Sources

Also known as 2766242, A-179039763, ASB-A-179039763, GHSA-69q9-9jgh-w2qc.