Stack-based buffer overflow in Qualcomm products - CVE-2023-28538
Published: September 4, 2023
Vulnerability identifier: #VU80364
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28538
CWE-ID: CWE-121
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WIN Product. A local application can execute arbitrary code.
Affected software
SM7250P
SD865 5G
SD870
SG4150P
SM4125
SM6250
SM6250P
Smart Audio 200 Platform
Snapdragon 850 Mobile Compute Platform
Snapdragon AR2 Gen 1 Platform
Snapdragon W5+ Gen 1 Wearable Platform
Snapdragon X50 5G Modem-RF System
Snapdragon X55 5G Modem-RF System
Snapdragon XR1 Platform
Snapdragon XR2 5G Platform
SD7c
SD768G
SD765G
SD765
SD750G
SD720G
SD695
SD690 5G
SD680
SD678
WCD9341
WSA8835
WSA8830
WSA8815
WSA8810
WCN3990
WCN3988
WCN3980
WCN3950
WCN3910
WCD9385
WCD9380
WCD9375
WCD9371
WCD9370
WCD9340
WCD9335
WCD9326
Vision Intelligence 400 Platform
Vision Intelligence 300 Platform
SXR2230P
SXR1230P
SXR1120
SW5100P
SW5100
SSG2125P
SSG2115P
Snapdragon 4 Gen 1
Snapdragon XR2+ Gen 1 Platform
QCA6595
QCA6431
QCA6436
QCA6564
QCA6564A
QCA6564AU
QCA6574
QCA6574A
QCA6430
QCA6595AU
QCA6696
QCM2290
QCM4290
QCM4325
QCM6125
QCN7606
QCN9011
QCA6426
QCA6421
QCA6420
QCA6391
QCA6335
QCA6310
FSM10056
Flight RB5 5G Platform
FastConnect 7800
FastConnect 6900
FastConnect 6800
FastConnect 6200
CSRA6640
CSRA6620
SA6150P
SD662
SD480
SD460
SD 8cx Gen2
SD 8CX
SD 8 Gen1 5G
SD 675
SC8180X+SDX55
SA8195P
SA8155P
SA8155
SA8150P
SA8145P
SA6155
AQT1000
SA6145P
SA4155P
SA4150P
Qualcomm Robotics RB5 Platform
Qualcomm Robotics RB3 Platform
QSM8250
QRB5165N
QRB5165M
QCS6125
QCS610
QCS4290
QCS410
QCS2290
QCN9012
SD855
SDX55
SD845
SD730
SD712
SD710
SD675
SD670
WSA8832
SD665
SXR2130
QCA6574AU
QCA6174A
SA6155P
QCS8155
Google Android
SD865 5G
SD870
SG4150P
SM4125
SM6250
SM6250P
Smart Audio 200 Platform
Snapdragon 850 Mobile Compute Platform
Snapdragon AR2 Gen 1 Platform
Snapdragon W5+ Gen 1 Wearable Platform
Snapdragon X50 5G Modem-RF System
Snapdragon X55 5G Modem-RF System
Snapdragon XR1 Platform
Snapdragon XR2 5G Platform
SD7c
SD768G
SD765G
SD765
SD750G
SD720G
SD695
SD690 5G
SD680
SD678
WCD9341
WSA8835
WSA8830
WSA8815
WSA8810
WCN3990
WCN3988
WCN3980
WCN3950
WCN3910
WCD9385
WCD9380
WCD9375
WCD9371
WCD9370
WCD9340
WCD9335
WCD9326
Vision Intelligence 400 Platform
Vision Intelligence 300 Platform
SXR2230P
SXR1230P
SXR1120
SW5100P
SW5100
SSG2125P
SSG2115P
Snapdragon 4 Gen 1
Snapdragon XR2+ Gen 1 Platform
QCA6595
QCA6431
QCA6436
QCA6564
QCA6564A
QCA6564AU
QCA6574
QCA6574A
QCA6430
QCA6595AU
QCA6696
QCM2290
QCM4290
QCM4325
QCM6125
QCN7606
QCN9011
QCA6426
QCA6421
QCA6420
QCA6391
QCA6335
QCA6310
FSM10056
Flight RB5 5G Platform
FastConnect 7800
FastConnect 6900
FastConnect 6800
FastConnect 6200
CSRA6640
CSRA6620
SA6150P
SD662
SD480
SD460
SD 8cx Gen2
SD 8CX
SD 8 Gen1 5G
SD 675
SC8180X+SDX55
SA8195P
SA8155P
SA8155
SA8150P
SA8145P
SA6155
AQT1000
SA6145P
SA4155P
SA4150P
Qualcomm Robotics RB5 Platform
Qualcomm Robotics RB3 Platform
QSM8250
QRB5165N
QRB5165M
QCS6125
QCS610
QCS4290
QCS410
QCS2290
QCN9012
SD855
SDX55
SD845
SD730
SD712
SD710
SD675
SD670
WSA8832
SD665
SXR2130
QCA6574AU
QCA6174A
SA6155P
QCS8155
Google Android
How to mitigate CVE-2023-28538
Install security update from vendor's website.
Google Android - addressed in versions 11 2023-09-05, 12L 2023-09-05, 12 2023-09-05, 13 2023-09-05