CVE-2021-35104

Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity…

Critical · published June 14, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

🔥 A crafty buffer overflow is lurking in the parsing of FLAC audio headers, impacting multiple Snapdragon platforms! 🔥 Think of this like a music playlist that keeps trying to play songs that are way too long for the speaker — it overflows, distorting the sound and potentially causing the whole system to crash or misbehave! An attacker could exploit this vulnerability to gain control over the affected device, resulting in anything from a simple crash to executing malicious code — a nightmare for any user relying on their tech for safety or performance. Imagine your smart car suddenly taking an unexpected detour!

Put simply

Think of this like a music playlist that keeps trying to play songs that are way too long for the speaker — it overflows, distorting the sound and potentially causing the whole system to crash or misbehave! This buffer overflow occurs due to improper handling of audio headers when playing FLAC clips, allowing an attacker to inject oversized data, leading to unexpected behavior or full system compromise.

What to do

An attacker could exploit this vulnerability to gain control over the affected device, resulting in anything from a simple crash to executing malicious code — a nightmare for any user relying on their tech for safety or performance. Imagine your smart car suddenly taking an unexpected detour! Make sure to update your Snapdragon components to the latest version as soon as possible to patch this vulnerability. Stay vigilant by monitoring for any announcements regarding firmware updates from Qualcomm. 🚨 You've got this! By following these steps, you'll ensure your devices remain secure and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00827 · 57.0th percentile
Published
2022-06-14T10:11Z
EPSS history
Timeline
  • 14 JUN 10:11Z
    Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity…
    cvelistv5