CVE-2021-30298
Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.14% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- qualcomm/ar8031 firmware · qualcomm/ar8035 firmware · qualcomm/csra6620 firmware · qualcomm/csra6640 firmware · qualcomm/fsm10055 firmware · qualcomm/fsm10056 firmware · qualcomm/ipq8072a firmware · qualcomm/ipq8074a firmware · qualcomm/ipq8076a firmware · qualcomm/mdm9150 firmware · qualcomm/qca6390 firmware · qualcomm/qca6391 firmware · qualcomm/qca6574au firmware · qualcomm/qca6595au firmware · qualcomm/qca6696 firmware · qualcomm/qca8337 firmware · qualcomm/qcn9000 firmware · qualcomm/qcn9074 firmware · qualcomm/qcs405 firmware · qualcomm/qcs410 firmware · +40 more
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.