CVE-2021-35078 — Missing Release of Memory after Effective Lifetime in Google Android

CWE-401 — Missing Release of Memory after Effective Lifetime3 documents3 sources

Severity

7.5HIGHNVD

EPSS

0.5%

top 31.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Android

Timeline

PublishedJun 14

Latest updateJun 15

Description

Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶googlegoogle/android

🔴Vulnerability Details

GHSA

GHSA-663m-hm4m-rjg6: Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Comp↗2022-06-15

▶

📋Vendor Advisories

Android

CVE-2021-35078: Closed-source component↗2022-05-01

▶