CVE-2021-35134 Memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

High 8.4 Published 2 Sep 2022 Updated 4 Aug 2024

Insufficient ELF header validation in Snapdragon Boot allows memory corruption, potentially enabling code execution or privilege escalation on affected devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-35134?

CVE-2021-35134 is a high-severity memory corruption vulnerability in Qualcomm Qca6391 Firmware, published on 2 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Weakness: CWE-131

Which versions are affected by CVE-2021-35134?

It affects 30 products.

Products include Qualcomm Qca6391 Firmware, Qualcomm Qcm6490 Firmware, Qualcomm Qcs6490 Firmware, Qualcomm Qsm8350 Firmware, Qualcomm Sd778g Firmware, Qualcomm Sd780g Firmware and 24 more.

How do I fix CVE-2021-35134?

No fix has been published for CVE-2021-35134 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-35134 being exploited?

There is no known exploitation of CVE-2021-35134 in the wild and no public exploit code.

All Qualcomm Qca6391 Firmware vulnerabilities

Sources

Also known as GHSA-39x7-j43f-hqfr.