CVE-2021-1941 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
A buffer over-read in Qualcomm Snapdragon firmware allows attackers to read memory or cause denial of service via malicious WPA IE strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-1941?
CVE-2021-1941 is a high-severity memory corruption vulnerability in Qualcomm Apq8064au Firmware, published on 9 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Weakness: CWE-125
Which versions are affected by CVE-2021-1941?
It affects 215 products.
Products include Qualcomm Apq8064au Firmware, Qualcomm Apq8096au Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware, Qualcomm Ar9380 Firmware and 209 more.
How do I fix CVE-2021-1941?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-1941 being exploited?
There is no known exploitation of CVE-2021-1941 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8064au Firmware
Sources
Also known as 2832873, A-184561795, ASB-A-184561795, GHSA-692h-q5hm-h622.