CVE-2021-30290 Null dereference in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
A race condition in Qualcomm Snapdragon components causes a null pointer dereference, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-30290?
CVE-2021-30290 is a high-severity vulnerability in Qualcomm Qca6174a Firmware, published on 9 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Which versions are affected by CVE-2021-30290?
It affects 41 products.
Products include Qualcomm Qca6174a Firmware, Qualcomm Qca6574 Firmware, Qualcomm Qca6574a Firmware, Qualcomm Qca6574au Firmware, Qualcomm Qca6595au Firmware, Qualcomm Qca6696 Firmware and 35 more.
How do I fix CVE-2021-30290?
Apply the vendor's patch.
Is CVE-2021-30290 being exploited?
There is no known exploitation of CVE-2021-30290 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qca6174a Firmware
Sources
Also known as 2897378, A-190403706, ASB-A-190403706, GHSA-mjg6-fgp9-mhgq.