CVE-2021-1985 : What You Need to Know
Discover the impacts and technical details of CVE-2021-1985 affecting Qualcomm Snapdragon products. Learn about prevention measures and security updates from Qualcomm.
Qualcomm, Inc. has reported a CVE-2021-1985 affecting various Snapdragon products including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, and Wearables. The vulnerability involves a possible buffer over-read due to a lack of data length check in the QVR Service configuration.
Understanding CVE-2021-1985
This section provides an overview of the CVE-2021-1985 vulnerability.
What is CVE-2021-1985?
The CVE-2021-1985 vulnerability is related to a buffer over-read in the QVR Service configuration in multiple Snapdragon products by Qualcomm, Inc.
The Impact of CVE-2021-1985
The impact of the CVE-2021-1985 vulnerability is rated with a CVSS base score of 8.4 (High severity). The vulnerability has a high impact on confidentiality, integrity, and availability, with low attack complexity and a local attack vector.
Technical Details of CVE-2021-1985
This section covers technical details of CVE-2021-1985.
Vulnerability Description
The vulnerability involves a possible buffer over-read due to the absence of data length checks in the QVR Service configuration.
Affected Systems and Versions
The vulnerability affects a wide range of Snapdragon products including APQ series, MSM series, QCA series, QCM series, QCS series, Qualcomm215, SD series, SM series, WCD series, WCN series, WSA series, and more. Refer to the vendor’s bulletin for the complete list of affected versions.
Exploitation Mechanism
The CVE-2021-1985 vulnerability does not require any special privileges for exploitation and can be triggered locally with no user interaction.
Mitigation and Prevention
Discover how to address the CVE-2021-1985 vulnerability.
Immediate Steps to Take
Users are advised to apply security patches provided by Qualcomm and follow best practices for secure software development.
Long-Term Security Practices
Ensure regular security updates are maintained, implement secure coding practices, and conduct security assessments to detect and mitigate similar vulnerabilities.
Patching and Updates
Qualcomm has released security bulletins detailing patches and updates to address the CVE-2021-1985 vulnerability.