PT-2024-19852 · Qualcomm · Qualcomm Snapdragon Compute

Published 2024-11-04 · Updated 2024-11-07 · CVE-2024-23377

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Compute up to WSA8845H EVA driver (affected versions not specified)

Description The issue is related to memory corruption that occurs when a user invokes an IOCTL command from user-space and modifies the original packet size of the command after system properties have been sent to the EVA driver. This can lead to potential local attacks.

Recommendations For Qualcomm Snapdragon Compute up to WSA8845H, upgrade affected components immediately. For the EVA driver, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-823

Related Identifiers

CVE-2024-23377

Affected Products

Qualcomm Snapdragon Compute

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-23377 · Security Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html · Vendor Advisory
• https://t.me/cvedetector/9718 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853436000048927085 · Twitter Post
• https://twitter.com/oktsec/status/1853401200298692768 · Twitter Post
• https://twitter.com/CVEnew/status/1853381326159917487 · Twitter Post
• https://t.me/cvenotify/100976 · Telegram Post
• https://t.me/cvenotify/100466 · Telegram Post