CVE-2021-30294 Null dereference in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
A null pointer dereference in the KGSL GPU driver allows attackers to cause a denial of service via improper input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-30294?
CVE-2021-30294 is a high-severity vulnerability in Qualcomm Qca6174a Firmware, published on 9 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Weakness: CWE-476
Which versions are affected by CVE-2021-30294?
It affects 41 products.
Products include Qualcomm Qca6174a Firmware, Qualcomm Qca6574 Firmware, Qualcomm Qca6574a Firmware, Qualcomm Qca6574au Firmware, Qualcomm Qca6595au Firmware, Qualcomm Qca6696 Firmware and 35 more.
How do I fix CVE-2021-30294?
Apply the vendor's patch.
Is CVE-2021-30294 being exploited?
There is no known exploitation of CVE-2021-30294 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qca6174a Firmware
Sources
Also known as 2900322, A-190404324, ASB-A-190404324, GHSA-rv54-hf76-46cc.