CVE-2021-30304 : Possible buffer out of bound read can occur due to improper validation of TBTT c

Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity

Published 2021-10-20 07:15:09

Updated 2021-10-26 18:46:29

Source Qualcomm, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-30304

Qualcomm » Qca2066 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca2066 » Version: N/A
Qualcomm » Wcn6850 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn6850 » Version: N/A
Qualcomm » Wcn6851 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn6851 » Version: N/A
Qualcomm » Wcn6855 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn6855 » Version: N/A
Qualcomm » Wcn6856 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn6856 » Version: N/A
Qualcomm » Wcd9380 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9380 » Version: N/A
Qualcomm » Wcd9385 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9385 » Version: N/A
Qualcomm » Wsa8830 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8830 » Version: N/A
Qualcomm » Wsa8835 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8835 » Version: N/A
Qualcomm » Qca2062 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca2062_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca2062 » Version: N/A
Qualcomm » Qca2064 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca2064_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca2064 » Version: N/A
Qualcomm » Qca2065 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca2065_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca2065 » Version: N/A
Qualcomm » Sc8280xp Firmware » Version: N/A
cpe:2.3:o:qualcomm:sc8280xp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sc8280xp » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-30304

EPSS FAQ

0.37%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-30304

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Qualcomm, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-30304

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-30304

https://www.qualcomm.com/company/product-security/bulletins/october-2021-bulletin

October 2021 Security Bulletin | Qualcomm
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-30304

Products affected by CVE-2021-30304

Exploit prediction scoring system (EPSS) score for CVE-2021-30304

CVSS scores for CVE-2021-30304

CWE ids for CVE-2021-30304

References for CVE-2021-30304