Security readout for executives and security teams
Plain-English summary
This vulnerability can cause a Qualcomm Snapdragon hypervisor to fail when virtual interrupt-controller control data is handled improperly. The documented impact is availability loss, not data theft or data modification. Business urgency is highest for Snapdragon-based mobile, compute, or automotive systems where device crashes or service interruption affect operations or safety-adjacent workflows.
Executive priority
Treat this as a high-priority availability risk for affected Snapdragon-based assets, especially operational mobile, compute, or automotive deployments. It is less urgent for confidentiality concerns, because the published impact does not include data disclosure or tampering.
Technical view
CVE-2021-35101 concerns improper handling of writes to virtual GICR control, leading to a hypervisor assertion failure. CVSS 3.1 is 7.1: local attack vector, low complexity, no privileges, no user interaction, changed scope, high availability impact, and no confidentiality or integrity impact.
Likely exposure
Exposure is limited to Qualcomm-listed Snapdragon Auto, Compute, and Mobile platforms and chipsets. Organizations should identify products using the named Qualcomm parts, then map each device to OEM firmware and security bulletin coverage.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector indicates local access is required, but no privileges or user interaction are required. No exploit method is provided in the sources.
Researcher notes
The public detail is sparse. The bundle names the vulnerable behavior and affected Qualcomm platforms, but does not include root-cause depth, exploit status, fixed versions, or device-specific OEM patch mapping. Avoid assuming all Snapdragon products are affected.
Mitigation direction
- Review Qualcomm’s June 2022 security bulletin for vendor guidance.
- Apply applicable OEM firmware or security updates when available.
- Prioritize automotive, compute, and mobile fleets with high availability requirements.
- Limit untrusted local code execution on affected devices where feasible.
- Track OEM advisories for device-specific remediation status.
Validation and detection
- Inventory device models and map them to Qualcomm chipsets.
- Compare chipsets against the affected product list in the CVE sources.
- Verify firmware or security patch level against Qualcomm and OEM advisories.
- Check whether affected devices use hypervisor or virtualization features.
- Document devices without available OEM remediation for risk acceptance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35101 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H2.54Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletinCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.