CVE-2021-1950
📋 TL;DR
This vulnerability allows authenticated users to bypass face authentication on affected Qualcomm Snapdragon devices due to improper secure memory cleaning between user sessions. It affects multiple Snapdragon platforms including Auto, Compute, Connectivity, Industrial IoT, Mobile, and Wired Infrastructure/Networking. Attackers with physical access or local privileges could potentially authenticate as other users.
💻 Affected Systems
- Snapdragon Auto
- Snapdragon Compute
- Snapdragon Connectivity
- Snapdragon Industrial IOT
- Snapdragon Mobile
- Snapdragon Wired Infrastructure and Networking
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access could bypass biometric authentication to gain unauthorized access to devices, potentially compromising sensitive data or device functionality.
Likely Case
Local authenticated users could bypass face authentication to escalate privileges or access other users' data on shared devices.
If Mitigated
With proper access controls and device security policies, impact is limited to local privilege escalation rather than remote compromise.
🎯 Exploit Status
Requires authenticated access to the device; exploitation involves manipulating secure memory between authentication sessions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Qualcomm March 2022 security bulletin for specific patched versions
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates. 2. Apply Qualcomm-provided patches through OEM updates. 3. Reboot device after update. 4. Verify patch installation through version checks.
🔧 Temporary Workarounds
Disable Face Authentication
allTemporarily disable face authentication feature until patches can be applied
Device-specific: Navigate to Settings > Security > Face Unlock > Disable
Enforce Strong Alternative Authentication
allRequire strong PIN/password authentication instead of or in addition to biometrics
Device-specific: Settings > Security > Screen lock > Set strong PIN/password
🧯 If You Can't Patch
- Implement strict physical access controls for affected devices
- Use device encryption and remote wipe capabilities to protect data if device is compromised
🔍 How to Verify
Check if Vulnerable:
Check device chipset model and firmware version against Qualcomm's affected product list in March 2022 bulletinCheck Version:
Android: Settings > About phone > Build number / Kernel versionVerify Fix Applied:
Verify firmware version has been updated to a version after the March 2022 Qualcomm security patches📡 Detection & Monitoring
Log Indicators:
- Multiple failed face authentication attempts followed by successful authentication
- Unusual authentication pattern changes
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Not applicable for this local authentication bypass vulnerability