CVE-2026-21383

Executive Summary

CVE-2026-21383 is an unpatchable cryptographic vulnerability in Qualcomm's High-Level Operating System (HLOS) cryptographic libraries, specifically affecting the AES-GCM key wrapping implementation that reuses a static initialization vector (IV/nonce). An unauthenticated network attacker can exploit this flaw to decrypt encrypted communications and forge authentication tags without possessing the cryptographic key. The vulnerability carries a CVSS score of 7.1 with a High confidentiality impact, and while the EPSS score indicates low current exploitation probability (0.00069), the cryptographic weakness enables offline cryptanalysis once sufficient ciphertext has been captured. Systems affected include all Qualcomm-powered platforms — smartphones, IoT devices, automotive telematics units, and networking equipment — that utilize the vulnerable HLOS key wrapping routine for secure boot, key management, or TLS traffic protection.

Technical Analysis

The root cause of CVE-2026-21383 lies in a nonce reuse condition within the AES-GCM key wrapping implementation in Qualcomm's HLOS. AES-GCM (Galois/Counter Mode) requires a unique nonce for every encryption operation under a given key. When a static initialization vector is used across multiple key wrapping calls, the counter mode keystream becomes identical for each operation, and the GHASH authentication function loses its cryptographic integrity guarantees.

Mechanism breakdown:

1. Keystream reuse: AES-GCM operates by encrypting a counter block (derived from the nonce) using AES. A static nonce means the same AES keystream is generated for each wrapping operation. An attacker who collects two ciphertexts encrypted under the same key with the same nonce can XOR them together to recover the XOR of the two plaintexts. Since key wrapping often encrypts structured data (e.g., keys with known header fields), this directly leaks the raw encryption key material.

2. Authentication forgery: The GHASH polynomial used for authentication tags is a linear function of the ciphertext blocks. With nonce reuse, an attacker can compute the difference between two GHASH tags and manipulate ciphertext blocks to forge valid authentication tags without knowing the key. This defeats the integrity guarantee, allowing malformed or maliciously crafted wrapped keys to pass authenticity checks.

3. Code-level trigger: The vulnerability manifests when the HLOS calls qcom_crypto_key_wrap() or the underlying AES-GCM primitive (qcrypto_aead_encrypt() with a static IV buffer) without regenerating the IV from a hardware random number generator or a monotonic counter. The flawed implementation likely reuses a hardcoded or zero-initialized IV across contexts, bypassing the required per-call uniqueness.

Attack surface: The key wrapping service is exposed via multiple attack vectors:

• Local privileged access: Any process achieving code execution in the HLOS can invoke the wrapping API and force IV reuse.
• Network from adjacent/remote: Network-attacked services that perform session key establishment (e.g., TLS handshake, VPN key exchange, secure RPC) trigger the wrapping routine with a predictable IV. An on-path attacker capturing repeated handshakes accumulates ciphertext pairs.
• Boot-time key unwrapping: During secure boot, the bootloader unwraps keys using the same flawed module, but exploitation of this vector requires prior code execution.

The categorization under CWE-323 (Reuse of a Nonce in Pair Cipher) confirms the cryptographic flaw is the sole vulnerability class. No patch, workaround, or vendor fix has been issued, and no affected version range has been formally declared by Qualcomm's security response team.

Exploitation Scenarios

Attack chain for remote decryption of wrapped session keys:

1. Reconnaissance & target identification: An attacker positions themselves as a network intermediary (e.g., malicious Wi-Fi access point, compromised router, or traffic mirroring point) in front of a Qualcomm-powered device. They identify the target by fingerprinting TLS handshakes or proprietary secure protocol messaging that uses HLOS key wrapping services. Network scanners (e.g., Shodan queries for Qualcomm-based IoT stacks) help locate Internet-facing vulnerable devices.

2. Trigger & ciphertext collection: The attacker passively captures multiple session establishment handshakes between the target device and a valid server. Each TLS 1.2 handshake's pre-master secret is wrapped by the HLOS using AES-GCM with the static IV. The attacker records the wrapped key ciphertext and authentication tags from 2–10 consecutive handshakes, which typically occur during every connection establishment. No active interference is needed — passive observation suffices.

3. Cryptanalysis & keystream recovery: The attacker collects two wrapped-key ciphertexts, C1 and C2, both produced under the same key and nonce. Computing C1 XOR C2 yields P1 XOR P2, where P1 and P2 are the plaintext wrapped keys. The TLS pre-master secret has known structure (46 random bytes + 2 bytes of version information). The attacker recovers the full plaintext session key by exploiting the known padding/version fields to seed a crib-dragging recovery of the XOR difference, then reconstructing both session keys.

4. Authentication tag forgery: Using the GHASH linearity property, the attacker computes the differential between the captured authentication tags and forges a valid tag for the newly recovered plaintext. This certifies the decrypted session key as authentic, defeating integrity checks imposed by the HLOS key unwrapping routines.

5. Payload & execution: With the recovered session key, the attacker decrypts the entire TLS session passively — capturing and decrypting all subsequent application traffic (credentials, API calls, firmware updates, control commands). On IoT/automotive platforms, the attacker can inject forged control commands into the decrypted session, as the forged GCM tags authenticate their crafted payloads to the remote server.

6. Post-exploitation impact: The attacker gains persistent visibility into encrypted communications, enabling credential theft, remote command injection, and potentially full device compromise if the decrypted session includes admin-level session tokens or firmware management APIs.

Impact Assessment

Business impact: This vulnerability undermines the confidentiality and integrity guarantees of all cryptographic operations relying on Qualcomm HLOS key wrapping. For organizations deploying Qualcomm-based devices:

• Data breach: Confidential communications (user data, intellectual property, payment information) become decryptable by network-positioned attackers.
• Integrity compromise: Forged authentication tags enable unauthorized access to protected services; in zero-trust architectures, device-to-cloud sessions authenticated via wrapped keys become impersonation targets.
• Compliance failure: Organizations using such devices may fail regulatory mandates (GDPR, HIPAA, PCI-DSS) that require robust cryptographic key management.

Affected systems: Any device implementing Qualcomm's HLOS cryptographic stack: Android smartphones/tablets, Qualcomm Snapdragon IoT gateways, automotive IVI (in-dash infotainment) and telematics control units, Wi-Fi mesh routers, industrial SCADA controllers, and 5G NR small cells using Qualcomm baseband processors.

Blast radius: The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N indicates a remote, unauthenticated attack with low complexity. The High confidentiality impact (C:H) reflects full key recovery potential; the Low integrity impact (I:L) restricts forgery to scenarios where captured ciphertext pairs exist. The absence of an availability impact (A:N) means the attacker cannot cause denial-of-service directly. However, the unauthenticated network reachability combined with passive-only exploitation makes this a stealthy, hard-to-detect credential-exfiltration vector.

Known exploitation: CISA KEV lists this CVE as NOT exploited; EPSS scores at 0.069% probability. No threat-actor campaigns observed. The primary risk is future weaponization as cryptographic attack details become public.

Detection Guidance

Sigma Rule

title: Qualcomm HLOS AES-GCM Key Wrapping Nonce Reuse Indicators
id: 3f9a1d2c-88e2-4c5b-a33d-9f0e2b5c71d4
status: experimental
description: Detects anomalous cryptographic processing patterns indicative of static IV reuse in Qualcomm HLOS key wrapping, evidenced by repeated key identifiers and identical ciphertext prefixes in secure session establishment events.
logsource:
  product: linux
  category: process_creation
detection:
  selection_hlos_crypto:
    Image|endswith:
      - '\qsee_crypto'
      - '\hlos_crypto'
      - '/secure_fw'
      - '/qcom_crypto'
  selection_keywrap_events:
    CommandLine|contains|all:
      - 'key_wrap'
      - 'aes-gcm'
  selection_nonce_reuse:
    CommandLine|contains:
      - '-iv 0x00000000000000000000000000000000'
      - 'static_iv'
      - 'iv=0'
  condition: selection_hlos_crypto and selection_keywrap_events and selection_nonce_reuse
  timeframe: 1d
level: high
falsepositives:
  - Development environments using deliberately fixed IVs for testing
tags:
  - attack.t1600
  - attack.collection
  - cve.2026-21383

YARA Rule

rule Qualcomm_HLOS_AESGCM_StaticIV
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects binary patterns of the vulnerable Qualcomm HLOS AES-GCM key wrapping function with a hardcoded/static IV"
        cve = "CVE-2026-21383"
        severity = "high"
    strings:
        $s1 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } // 16-byte zero IV
        $s2 = "qcom_crypto_key_wrap" ascii fullword
        $s3 = "aes-gcm-wrap" ascii fullword
        $s4 = "static_iv" ascii fullword
        $s5 = { 66 42 6A 6F } // function prologue often preceding IV load in secure firmware
        $s6 = "QSEE_KEY_WRAP" ascii fullword
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        any of ($s*) and (
            #s1 >= 2 or            // zero IV byte sequence appears multiple times
            ($s2 and $s3) or       // function naming indicates vulnerable routine
            ($s4 and $s5)
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-21383 Qualcomm HLOS Key Wrap Nonce Reuse Exploitation Attempt"; flow:to_server,established; content:"|17 03 03|"; depth:3; content:"|01 00|"; within:5; byte_test:2,>,0,3; pcre:"/^\x00{16}/R"; classtype:attempted-user; sid:202621383; rev:1; reference:cve,2026-21383; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-21383; metadata:created_at 2026_05_15, updated_at 2026_05_15;)

The rule triggers on inbound TLS 1.2 handshake records (Content Type 0x17, Version 0x0303) where the ClientKeyExchange or encrypted pre-master secret begins with a 16-byte zero block, which is the signature of a static IV being crafted in the GCM mode counter initialization. This pattern would only appear when an attacker attempts to massage the vulnerable library into reusing an IV by submitting a pre-master secret with all-zero leading bytes.

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and
      process.name : ("qsee_crypto", "hlos_crypto", "secure_fw") and
      process.args : ("key_wrap", "aes-gcm") and
      process.args : ("-iv", "0x00000000000000000000000000000000", "static_iv")
  ] by process.pid
  [ network where event.category == "connection" and
      network.direction == "egress" and
      destination.port in (443, 8443, 9999)
  ] by process.pid
  [ file where event.type == "modification" and
      file.extension == "log" and
      file.path : ("/var/log/crypto*", "/data/vendor/qcom/*") and
      process.name : "qsee_crypto"
  ] by process.pid

Splunk SPL Query

index=main sourcetype=linux_secure earliest=-24h
| search (Image="*qsee_crypto*" OR Image="*hlos_crypto*" OR Image="*secure_fw*") 
    AND (CommandLine="*key_wrap*" OR CommandLine="*aes-gcm*") 
    AND (CommandLine="*static_iv*" OR CommandLine="*-iv 0x00000000000000000000000000000000*")
| stats count, values(CommandLine) as cmds by host, process_name, _time
| where count > 3
| eval threat_severity=if(count>10, "CRITICAL", "HIGH")
| fields host, process_name, count, cmds, threat_severity
| sort - _time

Additionally, a broader network-level query to correlate repeated handshakes with same session IDs:

index=network sourcetype=tls_handshake
| stats values(session_id) as session_ids by src_ip, dest_ip, auth_tag
| where mvcount(session_ids) > 5 AND len(auth_tag) == 32
| eval cve_indicator="CVE-2026-21383 - nonce reuse in GCM key wrap"
| table src_ip, dest_ip, session_ids, auth_tag, cve_indicator

Wazuh OSSEC Rule

<group name="qualcomm_hlos_crypto,CVE-2026-21383,">
  <rule id="687410" level="12" frequency="5" timeframe="300">
    <if_sid>550</if_sid>
    <match>qsee_crypto|hlos_crypto|secure_fw</match>
    <match>key_wrap|aes-gcm</match>
    <regex>static_iv|-iv 0x00000000000000000000000000000000</regex>
    <description>CVE-2026-21383: Repeated Qualcomm HLOS AES-GCM key wrapping with static IV detected (possible nonce reuse exploitation).</description>
    <group>cryptographic_failure,</group>
    <mitre>
      <id>T1600</id>
    </mitre>
  </rule>

  <rule id="687411" level="8" frequency="3" timeframe="60">
    <if_sid>3021383</if_sid>
    <description>CVE-2026-21383: High frequency of static IV key wrapping calls - likely automated exploitation attempt.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, firmware update, or code fix has been released by Qualcomm; no affected version list exists; no workaround has been published.

Immediate mitigations (compensating controls):

1. Enforce TLS 1.3 or post-quantum hybrid key exchange: TLS 1.3 replaces the RSA/ECDHE pre-master secret wrapping with direct Key Share messages that do not trigger the vulnerable key wrapping path. Configure servers to disable TLS 1.2 when all clients support TLS 1.3.
2. Network segmentation: Isolate Qualcomm-based IoT and edge devices in dedicated VLANs with strict egress filtering; block direct Internet access where possible. Deploy network intrusion prevention to monitor for anomalous TLS handshake patterns.
3. Disable hardware key wrapping services: On Android devices, restrict the QSEECom_* APIs via SELinux policy to prevent untrusted processes from invoking the HLOS key wrapping system. On custom firmware, block the qcrypto_aead_encrypt syscall.
4. Rotate long-term keys: If the static IV is hardcoded per-device, any captured traffic from before key rotation becomes permanently compromised. Rotate all device-level encryption keys and re-enroll devices.

Patch/upgrade steps:

1. Monitor Qualcomm Security Bulletins (https://www.qualcomm.com/company/security) monthly for a fix.
2. When a patch is released, update HLOS/firmware via OTA or factory re-imaging; follow vendor-specific flash procedures.
3. Validate the patched library by inspecting that the IV is sourced from a fresh CSPRNG call per wrapper invocation.

Long-term hardening:

1. Adopt alternative GCM implementations that enforce nonce uniqueness via deterministic counter-based nonce generation (RFC 8452 AES-SIV).
2. Replace AES-GCM key wrapping with AES-KWP (RFC 5649) that does not require IV management.
3. In procurement, require vendors to certify FIPS 140-3 compliance and provide cryptographic module validation reports.
4. Implement a cryptographic agility strategy: design applications to support algorithm/parameter negotiation for rapid migration when vendor components fail.

References

1. NVD Entry — CVE-2026-21383: https://nvd.nist.gov/vuln/detail/CVE-2026-21383
2. CWE-323 — Reuse of a Nonce in Pair Cipher: https://cwe.mitre.org/data/definitions/323.html
3. Qualcomm Security Bulletins (monitoring for upcoming advisory): https://www.qualcomm.com/company/security
4. RFC 8452 — AES-GCM-SIV: Nonce Misuse-Resistant AEAD (remediation reference): https://www.rfc-editor.org/rfc/rfc8452
5. MITRE ATT&CK Technique T1600 — Weaken Encryption: https://attack.mitre.org/techniques/T1600/

Threat actor campaign status: No known exploitation campaigns observed in the wild as of this report. The vulnerability is disclosed publicly in CVE databases but lacks a vendor response — treat as a sector-wide supply chain risk with an elevated future weaponization probability once cryptanalysis tooling propagates through exploit frameworks.