CVE-2021-1947
Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.16% probability · 5th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- qualcomm/apq8009w firmware · qualcomm/apq8053 firmware · qualcomm/ar9380 firmware · qualcomm/ipq8064 firmware · qualcomm/ipq8065 firmware · qualcomm/ipq8068 firmware · qualcomm/ipq8069 firmware · qualcomm/msm8909w firmware · qualcomm/msm8953 firmware · qualcomm/qca6320 firmware · qualcomm/qca6390 firmware · qualcomm/qca6391 firmware · qualcomm/qca6426 firmware · qualcomm/qca8337 firmware · qualcomm/qca9531 firmware · qualcomm/qca9558 firmware · qualcomm/qca9561 firmware · qualcomm/qca9563 firmware · qualcomm/qca9880 firmware · qualcomm/qca9882 firmware · +40 more
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.