Integer underflow in Qualcomm products - CVE-2023-21630

Vulnerability identifier: #VU74332

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-21630

CWE-ID: CWE-191

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Multimedia Framework. A local application can execute arbitrary code.

WCD9375
Snapdragon 778G+ 5G Mobile Platform (SM7325-AE)
Snapdragon 780G 5G Mobile Platform
Snapdragon 782G Mobile Platform (SM7325-AF)
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 888 5G Mobile Platform
Snapdragon 888+ 5G Mobile Platform (SM8350-AC)
SW5100
SW5100P
WCD9370
Snapdragon 778G 5G Mobile Platform
WCD9380
WCD9385
WCN3950
WCN3980
WCN3988
WCN6740
WSA8810
WSA8830
WSA8835
SA8155P
FastConnect 6900
FastConnect 7800
QCA6391
QCA6574
QCA6574A
QCA6595AU
QCA6696
FastConnect 6700
SA8195P
SD 8 Gen1 5G
SD778G
SG4150P
SM7315
SM7325P
Snapdragon 680 4G Mobile Platform
Snapdragon 685 4G Mobile Platform (SM6225-AD)
Samsung Mobile Firmware
QCA6574AU
SA6155P
SD888
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 11 2023-04-05, 12L 2023-04-05, 12 2023-04-05, 13 2023-04-05
Samsung Mobile Firmware - update to SMR-MAY-2023

• https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Samsung Mobile Firmware