Buffer overflow in Qualcomm products - CVE-2023-43556

Vulnerability identifier: #VU91026

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-43556

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Hypervisor. A local application can execute arbitrary code.

Snapdragon 7c+ Gen 3 Compute
Snapdragon X65 5G Modem-RF System
Snapdragon AR2 Gen 1 Platform
BB)
Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB
Snapdragon 888+ 5G Mobile Platform (SM8350-AC)
Snapdragon 888 5G Mobile Platform
Snapdragon 8+ Gen 1 Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon X70 Modem-RF System
Snapdragon 782G Mobile Platform (SM7325-AF)
Snapdragon 780G 5G Mobile Platform
Snapdragon 778G+ 5G Mobile Platform (SM7325-AE)
Snapdragon 778G 5G Mobile Platform
Snapdragon 4 Gen 2 Mobile Platform
SM7325P
SM7315
SDX57M
WCD9385
WSA8835
WSA8830
WSA8815
WSA8810
WCN6740
WCN3988
WCN3950
WCD9380
WCD9375
WCD9370
SXR2230P
SXR1230P
SSG2125P
SSG2115P
QCA6595
QCN6024
QCM6490
QCM5430
QCM4490
QCA8337
QCA8081
QCA6698AQ
QCA6696
QCN9011
QCA6391
QAM8295P
Flight RB5 5G Platform
FastConnect 7800
FastConnect 6900
FastConnect 6700
QRB5165M
SA8295P
Robotics RB5 Platform
Qualcomm Video Collaboration VC5 Platform
Qualcomm Video Collaboration VC3 Platform
QSM8350
QRB5165N
AR8035
QCS8250
QCS7230
QCS6490
QCS5430
QCS4490
QCN9024
QCN9012
WSA8832
SD888
QCA6574AU
SA9000P
SA8540P
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 12L 2024-06-05, 12 2024-06-05, 13 2024-06-05, 14 2024-06-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android