Type conversion in Qualcomm products - CVE-2023-21638

Vulnerability identifier: #VU77860

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-21638

CWE-ID: CWE-704

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Video. A local privileged application can execute arbitrary code.

Snapdragon X55 5G Modem-RF System
SD865 5G
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 855 Mobile Platform
Snapdragon 855+/860 Mobile Platform (SM8150-AC)
Snapdragon 865 5G Mobile Platform
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 870 5G Mobile Platform (SM8250-AC)
SA8195P
Snapdragon XR2 5G Platform
WCD9341
WCD9380
WSA8810
WSA8815
WSA8830
WSA8835
QCA6436
FastConnect 6200
FastConnect 6800
FastConnect 6900
FastConnect 7800
QCA6391
QCA6420
QCA6426
QCA6430
AQT1000
QCA6696
SA6145P
SA6150P
SA8145P
SA8150P
SA8155P
Pixel
SD855
SXR2130
QCA6574AU
SA6155P

Install security update from vendor's website.

Pixel - update to 2023-07-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Pixel