CVE-2021-35122

Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Critical · published September 2, 2022

CVSS v3.1
9.3
EPSS
0%
Percentile
2.0
In the wild
Unconfirmed
What it is

🔥 An improper input validation vulnerability in Snapdragon can allow rogue modifications to permissions, opening the door to chaos! Think of it like a security guard at a warehouse who fails to check IDs—anyone can walk in and start rearranging the stock, potentially leading to a complete mess! An attacker could exploit this flaw to change permissions within the IO space, impacting device functionality and risking the integrity of sensitive data. The consequences could be absolutely devastating, affecting a range of devices from cars to wearables, making this a nightmare scenario for manufacturers and users alike!

Put simply

Think of it like a security guard at a warehouse who fails to check IDs—anyone can walk in and start rearranging the stock, potentially leading to a complete mess! This vulnerability allows unauthorized modifications to the required permissions due to insufficient validation, potentially compromising the security of Snapdragon platforms across various categories, including automotive and consumer IoT devices.

What to do

An attacker could exploit this flaw to change permissions within the IO space, impacting device functionality and risking the integrity of sensitive data. The consequences could be absolutely devastating, affecting a range of devices from cars to wearables, making this a nightmare scenario for manufacturers and users alike! Immediate action is crucial! Ensure that you update your Snapdragon firmware to the patched version as soon as possible. Implement strict input validation checks to mitigate exploitation and double-check your device configurations for safety. Don't wait! You've got this! With prompt action, you can secure your devices and keep the vulnerabilities at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00124 · 2.0th percentile
Published
2022-09-02T11:30Z
EPSS history
Timeline
  • 02 SEP 11:30Z
    Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon…
    cvelistv5