PT-2024-2302 · Qualcomm · Qualcomm Embedded Platform

Published 2024-03-04 · Updated 2025-01-10 · CVE-2023-28582

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm embedded platform (affected versions not specified) Data Modem (affected versions not specified)

Description The issue is related to memory corruption in the Data Modem during the DTLS handshake, specifically when verifying the hello-verify message. This is caused by a buffer copy operation without checking the size of the input data, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For Qualcomm embedded platforms, consider restricting access to the DTLS handshake functionality until a patch is available. For Data Modem, as a temporary workaround, consider disabling the hello-verify message verification during the DTLS handshake until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

BDU:2024-02236

CVE-2023-28582

Affected Products

Qualcomm Embedded Platform

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-28582 · Security Note
• https://bdu.fstec.ru/vul/2024-02236 · Security Note
• https://qualcomm.com/company/product-security/bulletins/march-2024-bulletin · Vendor Advisory
• https://t.me/pentestingnews/44399 · Telegram Post
• https://t.me/cvenotify/72921 · Telegram Post
• https://t.me/cvenotify/76586 · Telegram Post
• https://t.me/cvenotify/107067 · Telegram Post
• https://twitter.com/fletch_ai/status/1775372725089157181 · Twitter Post
• https://twitter.com/hdH4dg8/status/1765914019758780536 · Twitter Post
• https://twitter.com/Dinosn/status/1765815013762027807 · Twitter Post
• https://twitter.com/cracbot/status/1765055085799784813 · Twitter Post