PT-2024-5348 · Qualcomm · Qualcomm Microprogram+1

Published 2024-01-01 · Updated 2024-07-04 · CVE-2024-21465

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm embedded platform software (affected versions not specified)

Description The issue is related to memory corruption that occurs while processing a key blob passed by the user. This can potentially allow an attacker to execute arbitrary code. The vulnerability is also described as a buffer overflow issue in the Qualcomm microprogram software, which enables reading data beyond the buffer boundaries in memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Out of bounds Read

Weakness Enumeration

CWE-126

CWE-125

Related Identifiers

BDU:2024-05981

CVE-2024-21465

Affected Products

Qualcomm Embedded Platform

Qualcomm Microprogram

References · 7

• https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21465 · Security Note
• https://bdu.fstec.ru/vul/2024-05981 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024070153 · Note
• https://source.android.com/docs/security/bulletin/2024-07-01?hl=ru · Note
• https://cybersecurity-help.cz/vdb/SB2024070167 · Note
• https://twitter.com/cracbot/status/1809105057440542973 · Twitter Post