CVE-2021-35106
📋 TL;DR
This vulnerability allows attackers to read memory beyond intended boundaries in Qualcomm Snapdragon chipsets due to improper WMI message length calculation. It affects numerous Snapdragon-powered devices across automotive, mobile, IoT, and wearable platforms. Successful exploitation could lead to information disclosure or system compromise.
💻 Affected Systems
- Snapdragon Auto
- Snapdragon Compute
- Snapdragon Connectivity
- Snapdragon Consumer IOT
- Snapdragon Industrial IOT
- Snapdragon Mobile
- Snapdragon Voice & Music
- Snapdragon Wearables
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or persistent backdoor installation
Likely Case
Information disclosure through memory read, potentially exposing sensitive data or system information
If Mitigated
Limited impact with proper memory protections and exploit mitigations in place
🎯 Exploit Status
Exploitation requires WMI message manipulation and knowledge of affected firmware
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Qualcomm March 2022 security bulletin for specific firmware versions
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates 2. Apply Qualcomm-provided firmware patches 3. Reboot device after update
🔧 Temporary Workarounds
Network segmentation
allIsolate affected devices from untrusted networks
WMI access restriction
linuxRestrict WMI interface access to trusted processes only
🧯 If You Can't Patch
- Implement strict network segmentation for affected devices
- Monitor for unusual WMI activity and memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against Qualcomm's March 2022 security bulletinCheck Version:
Device-specific commands vary by manufacturer (e.g., 'getprop ro.build.fingerprint' on Android)Verify Fix Applied:
Verify firmware version has been updated to patched version📡 Detection & Monitoring
Log Indicators:
- Unusual WMI message sizes or patterns
- Memory access violations in system logs
Network Indicators:
- Unexpected WMI protocol traffic
- Anomalous inter-process communication
SIEM Query:
Search for WMI-related errors or memory access violations in system logs