CVE-2021-35115
📋 TL;DR
This vulnerability in Qualcomm Snapdragon chipsets allows attackers to execute arbitrary code or cause denial of service through a use-after-free condition in the PVM backend when handling multiple sessions. It affects automotive and mobile devices using vulnerable Snapdragon chipsets.
💻 Affected Systems
- Snapdragon Auto
- Snapdragon Mobile
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or persistent backdoor installation
Likely Case
Device crash/reboot (denial of service) or limited code execution in kernel context
If Mitigated
No impact if patched or if exploit attempts are blocked by security controls
🎯 Exploit Status
Exploitation requires local access or malicious app installation; kernel-level vulnerability increases impact
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by device manufacturer - check specific device security updates
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer's security updates 2. Apply latest firmware/OS update 3. Reboot device 4. Verify patch installation
🔧 Temporary Workarounds
Restrict app installations
allPrevent installation of untrusted applications that could exploit this vulnerability
Enable verified boot
allEnsure device integrity through verified boot chain
🧯 If You Can't Patch
- Isolate affected devices from untrusted networks
- Implement application allowlisting to prevent malicious app execution
🔍 How to Verify
Check if Vulnerable:
Check device chipset model and firmware version against Qualcomm advisoryCheck Version:
adb shell getprop ro.build.fingerprint (Android) or check device settingsVerify Fix Applied:
Verify device has March 2022 or later security patches installed📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- PVM backend crash reports
- Unexpected process termination
Network Indicators:
- Unusual outbound connections from system processes
- Exploit kit traffic patterns
SIEM Query:
source="kernel" AND ("panic" OR "oops") AND "pvm"