PT-2024-25081 · Qualcomm · Qualcomm Snapdragon Auto To Xr2 5G Platform

Published 2024-12-02 · Updated 2024-12-11 · CVE-2024-33036

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto to XR2 5G Platform (affected versions not specified)

Description The issue involves memory corruption when analyzing sensor packets in the camera driver. A user-space variable is used while allocating memory in the kernel and parsing, which can lead to huge allocation or invalid memory access. This occurs due to the use of a user-space variable in memory allocation within the kernel, potentially resulting in out-of-range pointer offsets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-823

Related Identifiers

CVE-2024-33036

Affected Products

Qualcomm Snapdragon Auto To Xr2 5G Platform

References · 6

• https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33036 · Security Note
• https://twitter.com/CVEnew/status/1863533980722549145 · Twitter Post
• https://t.me/cvedetector/11765 · Telegram Post
• https://twitter.com/oktsec/status/1863578319418986852 · Twitter Post
• https://t.me/cvenotify/102783 · Telegram Post