PT-2024-5263 · Qualcomm · Qualcomm Embedded Platform

Published 2024-01-01 · Updated 2024-07-02 · CVE-2024-21460

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Qualcomm embedded platform software (affected versions not specified)

Description The issue is related to information disclosure when Address Space Layout Randomization (ASLR) relocates certain portions in virtual address space as one chunk. Additionally, there is a kernel vulnerability in Qualcomm's microprogrammable software that involves the use of insufficiently random values, which could allow an attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2024-05882

CVE-2024-21460

Affected Products

Qualcomm Embedded Platform

References · 6

• https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21460 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024070167 · Note
• http://source.android.com/docs/security/bulletin/2024-07-01 · Note
• https://cybersecurity-help.cz/vdb/SB2024070153 · Note