Use After Free in Qualcomm products - CVE-2024-33040
Published: December 3, 2024
Vulnerability identifier: #VU101158
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-33040
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera Driver. A local privileged application can execute arbitrary code.
Affected software
Snapdragon W5+ Gen 1 Wearable Platform
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3680B
WCN3660B
WCD9380
SW5100P
SW5100
Snapdragon XR2 5G Platform
Snapdragon X55 5G Modem-RF System
FastConnect 6800
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
SA8255P
QCA6678AQ
QCA6595AU
QCA6436
QCA6426
QCA6391
QAM8255P
FastConnect 7800
FastConnect 6900
SXR2130
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3680B
WCN3660B
WCD9380
SW5100P
SW5100
Snapdragon XR2 5G Platform
Snapdragon X55 5G Modem-RF System
FastConnect 6800
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
SA8255P
QCA6678AQ
QCA6595AU
QCA6436
QCA6426
QCA6391
QAM8255P
FastConnect 7800
FastConnect 6900
SXR2130
How to mitigate CVE-2024-33040
Install security update from vendor's website.