CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
Description
CVE-2021-1906 is a medium-severity vulnerability affecting multiple Qualcomm chipsets across a wide range of product families including Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. The vulnerability involves improper handling of address deregistration on failure, which can lead to new GPU address allocation failure and denial of service. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 0.15% (35.4th percentile), exploitation probability remains low but the confirmed KEV listing underscores the real-world risk this vulnerability poses to affected devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | apq8009 firmware | - |
| qualcomm | apq8009w firmware | - |
| qualcomm | apq8017 firmware | - |
| qualcomm | apq8053 firmware | - |
| qualcomm | apq8064au firmware | - |
| qualcomm | apq8096au firmware | - |
| qualcomm | aqt1000 firmware | - |
| qualcomm | ar8031 firmware | - |
| qualcomm | ar8035 firmware | - |
| qualcomm | ar8151 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | csrb31024 firmware | - |
| qualcomm | fsm10055 firmware | - |
| qualcomm | fsm10056 firmware | - |
| qualcomm | mdm9150 firmware | - |
| qualcomm | mdm9206 firmware | - |
| qualcomm | mdm9250 firmware | - |
| qualcomm | mdm9607 firmware | - |
| qualcomm | mdm9626 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1906(US Government Resource)
Weakness Type
Detection of Error Condition Without Action
This vulnerability relates to a detection of error condition without proper action, where the system detects an error during GPU address deregistration but fails to handle it appropriately. In CVE-2021-1906, when the Qualcomm GPU driver encounters a failure during address deregistration, it does not take corrective action, leading to a state where subsequent GPU address allocations fail, causing denial of service for graphics-dependent operations.
Learn more: No CWE identifier has been formally assigned to this vulnerability by NVD.
Impact Analysis
CVE-2021-1906 carries a CVSS 3.1 score of 6.2 (MEDIUM), indicating a moderate threat level that primarily affects device availability. The vulnerability requires local access but has low attack complexity and requires no authentication or user interaction. Confidentiality (None): This vulnerability does not expose sensitive data. Integrity (None): No data modification is possible through this flaw. Availability (High): Successful exploitation causes GPU address allocation failures, which can render graphics-dependent applications and services non-functional, effectively causing a denial of service on the affected device. The scope is unchanged, meaning the impact is contained within the vulnerable GPU component. While the EPSS score of 0.15% suggests exploitation is not widespread, the CISA KEV listing confirms that this vulnerability has been actively exploited in targeted attacks, likely as part of exploit chains targeting mobile devices.
Exploit Maturity
CVE-2021-1906 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Despite the relatively low EPSS score of 0.15% (35.4th percentile), which suggests exploitation is not widespread, the KEV listing indicates this vulnerability has been used in targeted attacks. No public exploit code has been identified in the available references, suggesting exploitation may be limited to sophisticated threat actors. This vulnerability was likely exploited as part of a broader exploit chain targeting Qualcomm-based mobile devices, potentially in combination with CVE-2021-1905, a related use-after-free vulnerability in Qualcomm GPU drivers that was added to the KEV catalog around the same time.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Qualcomm has released patches through the May 2021 security bulletin.
- Ensure all affected Qualcomm chipset firmware is updated through the device manufacturer's official update channels (OEM firmware updates for Android devices, embedded system vendor updates for IoT deployments).
- For devices that cannot be immediately updated, limit exposure by restricting physical and local access to affected devices, disabling unnecessary GPU-intensive features, and implementing application sandboxing to contain potential exploitation attempts.
- Monitor affected devices for unusual GPU-related errors, application crashes, or unexplained denial-of-service conditions that could indicate exploitation of this vulnerability.
- Review the full list of affected Qualcomm chipsets in the May 2021 Qualcomm security bulletin and conduct an inventory to identify all impacted devices in your environment, prioritizing updates for internet-facing or mission-critical systems.
Technical Details
CVE-2021-1906 affects the GPU driver in multiple Qualcomm chipset families including Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables platforms. The vulnerability exists in the improper handling of address deregistration when multiple processes simultaneously interact with the GPU driver. When an address deregistration operation fails, the driver does not properly handle the error condition, leaving the internal address management state inconsistent. This inconsistency causes subsequent GPU address allocation requests to fail, resulting in a denial of service for any process requiring GPU resources. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms local access is required, but exploitation is straightforward with no privileges or user interaction needed, and the impact is limited to availability.
Frequently Asked Questions
Is CVE-2021-1906 being actively exploited?
Yes. CVE-2021-1906 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Despite the low EPSS score of 0.15%, the KEV listing indicates targeted exploitation has occurred, likely as part of broader mobile device exploit chains.
What products are affected by CVE-2021-1906?
CVE-2021-1906 affects a wide range of Qualcomm chipsets across Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables product families. The full list includes dozens of chipset firmware packages such as APQ8009, APQ8017, APQ8053, MDM9150, MDM9206, MDM9607, and many more.
How do I fix CVE-2021-1906?
Apply updates per vendor instructions through Qualcomm's May 2021 security bulletin. For end-user devices, apply OEM firmware updates from the device manufacturer. For IoT and embedded devices, coordinate with the device vendor for updated firmware.
How severe is CVE-2021-1906?
CVE-2021-1906 has a CVSS 3.1 score of 6.2 (MEDIUM) with impact limited to availability (denial of service). While the severity is moderate, the CISA KEV listing confirms real-world exploitation, warranting timely remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.