CVE-2021-35108 Security feature bypass in Snapdragon Connectivity, Snapdragon Mobile

Medium 6.8 Published 2 Sep 2022 Updated 4 Aug 2024

Attackers can bypass secure resource group permissions to gain unauthorized read and write access on Snapdragon devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-35108?

CVE-2021-35108 is a medium-severity vulnerability in Qualcomm Sd 8 Gen1 5g Firmware, published on 2 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile

Weakness: CWE-754

Which versions are affected by CVE-2021-35108?

It affects 15 products.

Products include Qualcomm Sd 8 Gen1 5g Firmware, Qualcomm Sm7450 Firmware, Qualcomm Sm8475 Firmware, Qualcomm Sm8475p Firmware, Qualcomm Wcd9370 Firmware, Qualcomm Wcd9375 Firmware and 9 more.

How do I fix CVE-2021-35108?

No fix has been published for CVE-2021-35108 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-35108 being exploited?

There is no known exploitation of CVE-2021-35108 in the wild and no public exploit code.

All Qualcomm Sd 8 Gen1 5g Firmware vulnerabilities

Sources

Also known as GHSA-hhq2-9p38-jwh9.