CVE-2021-35095 — Deserialization of Untrusted Data in Google Android

CWE-502 — Deserialization of Untrusted DataCWE-362 — Race Condition3 documents3 sources
Severity
7.0HIGHNVD
EPSS
0.1%
top 70.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Android
Timeline
PublishedJun 14
Latest updateJun 15

Description

Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in Snapdragon Connectivity, Snapdragon Mobile

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: www.qualcomm.com ↗Patch: www.qualcomm.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-7vc8-hf39-6395: Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same↗2022-06-15
▶

📋Vendor Advisories

1
Android
CVE-2021-35095: Kernel↗2022-04-01
▶
CVE-2021-35095 — Deserialization of Untrusted Data | cvebase