Reachable Assertion in Qualcomm products - CVE-2024-23350

Vulnerability identifier: #VU95343

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-23350

CWE-ID: CWE-617

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Multi Mode Call Processor. A remote attacker can perform a denial of service (DoS) attack.

QFW7114
WSA8845H
WSA8845
WSA8840
WCD9395
WCD9390
WCD9340
Snapdragon X75 5G Modem-RF System
Snapdragon X72 5G Modem-RF System
Snapdragon X35 5G Modem-RF System
Snapdragon Auto 5G Modem-RF Gen 2
Snapdragon 8 Gen 3 Mobile Platform
QFW7124
AR8035
QEP8111
QCN6274
QCN6224
QCC710
QCA8337
QCA8081
QCA6698AQ
QCA6584AU
FastConnect 7800
FastConnect 6900
QCA6174A
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 12L 2024-08-05, 12 2024-08-05, 13 2024-08-05, 14 2024-08-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android