Buffer overflow in Qualcomm products - CVE-2023-28580
Published: December 4, 2023
Vulnerability identifier: #VU83675
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28580
CWE-ID: CWE-120
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Host. A local privileged application can execute arbitrary code.
Affected software
WCD9370
SA8150P
SA8155P
SA8195P
SA8295P
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon X75 5G Modem-RF System
SW5100
SW5100P
WCD9340
WCD9341
SA8145P
WCD9380
WCN3660B
WCN3680B
WCN3950
WCN3980
WCN3988
WSA8810
WSA8815
WSA8830
WSA8835
QCN6224
FastConnect 6900
FastConnect 7800
QAM8295P
QCA6391
QCA6595AU
QCA6696
QCA8081
QCA8337
QCC710
AR8035
QCN6274
QCS410
QCS610
QFW7114
QFW7124
Qualcomm Video Collaboration VC1 Platform
Qualcomm Video Collaboration VC3 Platform
SA6145P
SA6150P
Pixel
QCA6574AU
SA6155P
SA8150P
SA8155P
SA8195P
SA8295P
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon X75 5G Modem-RF System
SW5100
SW5100P
WCD9340
WCD9341
SA8145P
WCD9380
WCN3660B
WCN3680B
WCN3950
WCN3980
WCN3988
WSA8810
WSA8815
WSA8830
WSA8835
QCN6224
FastConnect 6900
FastConnect 7800
QAM8295P
QCA6391
QCA6595AU
QCA6696
QCA8081
QCA8337
QCC710
AR8035
QCN6274
QCS410
QCS610
QFW7114
QFW7124
Qualcomm Video Collaboration VC1 Platform
Qualcomm Video Collaboration VC3 Platform
SA6145P
SA6150P
Pixel
QCA6574AU
SA6155P
How to mitigate CVE-2023-28580
Install security update from vendor's website.
Pixel - update to 2023-12-05