CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Description
CVE-2021-1905 is a high-severity use-after-free vulnerability affecting multiple Qualcomm chipsets used in Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables platforms. The vulnerability arises from improper handling of memory mapping when multiple processes simultaneously interact with the GPU driver, allowing an attacker to achieve arbitrary code execution or privilege escalation on the affected device. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 1.06% (77.4th percentile), CVE-2021-1905 represents a significant security risk for billions of devices running affected Qualcomm chipsets.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | apq8009 firmware | - |
| qualcomm | apq8009w firmware | - |
| qualcomm | apq8017 firmware | - |
| qualcomm | apq8053 firmware | - |
| qualcomm | apq8064au firmware | - |
| qualcomm | apq8096au firmware | - |
| qualcomm | aqt1000 firmware | - |
| qualcomm | ar8031 firmware | - |
| qualcomm | ar8035 firmware | - |
| qualcomm | ar8151 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | fsm10055 firmware | - |
| qualcomm | fsm10056 firmware | - |
| qualcomm | mdm9206 firmware | - |
| qualcomm | mdm9607 firmware | - |
| qualcomm | mdm9626 firmware | - |
| qualcomm | mdm9628 firmware | - |
| qualcomm | mdm9650 firmware | - |
| qualcomm | msm8909w firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1905(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) is a vulnerability that occurs when a program continues to reference memory after it has been freed, potentially allowing an attacker to execute arbitrary code or cause other unintended behavior. In CVE-2021-1905, the Qualcomm GPU driver improperly handles memory mapping when multiple processes access the GPU simultaneously, leading to a condition where freed memory is referenced, enabling potential code execution or privilege escalation on the affected device.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-1905 carries a CVSS 3.1 score of 8.4 (HIGH), indicating a serious threat to affected Qualcomm-based devices. The vulnerability requires local access but has low attack complexity and requires no authentication or user interaction, making it exploitable by any application running on the device. Confidentiality (High): Successful exploitation can allow an attacker to read sensitive memory contents, potentially including cryptographic keys, authentication tokens, and other protected data from other processes. Integrity (High): The use-after-free condition can be leveraged for arbitrary code execution with elevated GPU driver privileges, enabling system-level modifications including rootkit installation and persistent compromise. Availability (High): Exploitation can cause device instability, kernel panics, or complete system compromise requiring a factory reset. The scope is unchanged, meaning the direct impact is confined to the vulnerable GPU driver component, though code execution at the driver level effectively grants broad system access. The EPSS score of 1.06% combined with the CISA KEV listing confirms that this vulnerability has been exploited in real-world attacks against mobile devices.
Exploit Maturity
CVE-2021-1905 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 1.06% (77.4th percentile) indicates a notable probability of exploitation, and the KEV listing confirms that targeted exploitation has occurred in the wild. No public exploit code has been identified in the available references, suggesting exploitation has been limited to sophisticated threat actors conducting targeted attacks against mobile devices. This vulnerability is closely related to CVE-2021-1906, another Qualcomm GPU driver vulnerability added to the KEV catalog around the same time, and the two may have been chained together in attack scenarios targeting Qualcomm-based smartphones and IoT devices.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Qualcomm has released patches through the May 2021 security bulletin.
- Ensure all affected devices receive firmware updates through their respective OEM channels. For Android devices, apply the latest security patch level that includes the Qualcomm May 2021 fixes. For IoT and embedded platforms, coordinate with the device manufacturer for updated firmware images.
- For devices that cannot be immediately patched, implement application-level controls to restrict which applications can access GPU resources directly, reducing the attack surface for local exploitation.
- Deploy mobile device management (MDM) solutions to monitor device patch levels and enforce timely updates across the fleet, flagging devices running vulnerable chipset firmware for priority remediation.
- Conduct a comprehensive inventory of all Qualcomm-based devices in the environment, referencing the May 2021 Qualcomm security bulletin for the complete list of affected chipsets, and establish a prioritized patching schedule based on device criticality and exposure.
Technical Details
CVE-2021-1905 is a use-after-free vulnerability in the GPU driver across multiple Qualcomm chipset families, including Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. The vulnerability occurs due to improper handling of memory mapping when multiple processes simultaneously access GPU resources. During concurrent GPU memory operations, a race condition can lead to memory being freed while another process still holds a reference to it. Subsequent use of this freed memory can result in arbitrary code execution within the GPU driver context, which typically operates with elevated kernel-level privileges. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that while local access is required, the attack complexity is low and no privileges or user interaction are needed, with complete impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-1905 being actively exploited?
Yes. CVE-2021-1905 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 1.06% (77.4th percentile) further indicates a notable exploitation probability. Exploitation has been attributed to targeted attacks against mobile devices.
What products are affected by CVE-2021-1905?
CVE-2021-1905 affects a wide range of Qualcomm chipsets across Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables product families. Affected chipset firmware includes APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9607, MDM9650, and many others listed in Qualcomm's May 2021 security bulletin.
How do I fix CVE-2021-1905?
Apply updates per vendor instructions through Qualcomm's May 2021 security bulletin. For Android devices, install the latest available security patch from the device manufacturer. For embedded and IoT devices, coordinate with the OEM for firmware updates that include the Qualcomm fixes.
How severe is CVE-2021-1905?
CVE-2021-1905 has a CVSS 3.1 score of 8.4 (HIGH) with complete impact on confidentiality, integrity, and availability. Combined with the CISA KEV listing confirming active exploitation, this is a high-priority vulnerability requiring prompt remediation across all affected Qualcomm-based devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.