CVE-2021-30298

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking	AR8031, AR8035, CSRA6620, CSRA6640, FSM10055, FSM10056, IPQ8072A, IPQ8074A, IPQ8076A, MDM9150, QCA6390, QCA6391, QCA6574AU, QCA6595AU, QCA6696, QCA8337, QCN9000, QCN9074, QCS405, QCS410, QCS610, QRB5165, QRB5165N, Qualcomm215, SA8155P, SD205, SD210, SD460, SD662, SD665, SD765, SD765G, SD768G, SD865 5G, SD870, SDA429W, SDX55, SDX55M, SM7250P, WCD9335, WCD9340, WCD9341, WCD9370, WCD9375, WCD9380, WCD9385, WCN3610, WCN3620, WCN3660B, WCN3950, WCN3980, WCN3988, WCN3991, WCN3998, WCN3999, WCN6850, WCN6851, WSA8810, WSA8815, WSA8830, WSA8835

References

https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletinPatch, Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletinPatch, Vendor Advisory

Timeline

Published: Jan 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-302996.7Possible out of bound access in audio module due to lack of validation of user provided input.CVE-2021-30306.1Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colo CVE-2021-303007.5Possible denial of service due to incorrectly decoding hex data for the SIB2 OTA message and assigning a garbage value to choice when proces CVE-2021-303017.5Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snap CVE-2021-303027.5Improper authentication of EAP WAPI EAPOL frames from unauthenticated user can lead to information disclosure in Snapdragon Compute, Snapdra CVE-2021-303037.8Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, S CVE-2021-303049.1Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdra CVE-2021-303057.8Possible out of bound access due to lack of validation of page offset before page is inserted in Snapdragon Auto, Snapdragon Connectivity, S CVE-2021-303067.1Possible buffer over read due to improper buffer allocation for file length passed from user space in Snapdragon Auto, Snapdragon Connectivi CVE-2021-303077.5Possible denial of service due to improper validation of DNS response when DNS client requests with PTR, NAPTR or SRV query type in Snapdrag CVE-2021-303087.8Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto, Snapd CVE-2021-303097.8Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industria