PT-2023-9585 · Qualcomm · Qualcomm Snapdragon Auto

Published 2023-11-28 · Updated 2024-10-16 · CVE-2024-23376

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions prior to WSA8835

Description The issue is related to memory corruption that occurs when sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call. This can potentially allow an attacker to execute arbitrary code. The vulnerability is also described as a use-after-free issue in the Qualcomm Snapdragon Auto software.

Recommendations For Qualcomm Snapdragon Auto versions prior to WSA8835, patch the affected systems immediately to resolve the issue. As a temporary workaround, consider restricting access to the IOCTL call to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-08506

CVE-2024-23376

Affected Products

Qualcomm Snapdragon Auto

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-23376 · Security Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08506 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-23376 · Security Note
• https://twitter.com/oktsec/status/1843299765770911891 · Twitter Post
• https://t.me/cvedetector/7232 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1843307608783942133 · Twitter Post
• https://vuldb.com/?id.279466 · Note
• https://t.me/cvenotify/97245 · Telegram Post
• https://git.codelinaro.org/clo/la/platform/vendor/opensource/eva-kernel/-/commit/afb721141cd8a13acd5a0ae5d145746acb9ece5b · Note
• https://twitter.com/CVEnew/status/1843284024682287408 · Twitter Post