Use After Free in Qualcomm products - CVE-2024-38401
Published: September 2, 2024
Vulnerability identifier: #VU96699
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-38401
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Qualcomm
Affected software:
AR8035
C-V2X 9150
FastConnect 7800
QCA6574A
QCA6584AU
QCA6595AU
QCA6696
QCA6698AQ
QCA8081
QCA8337
QCC710
QCN6224
QCN6274
QCS410
QCS610
QFW7114
QFW7124
Qualcomm Video Collaboration VC1 Platform
Qualcomm Video Collaboration VC3 Platform
Snapdragon Auto 5G Modem-RF
Snapdragon Auto 5G Modem-RF Gen 2
Snapdragon W5+ Gen 1 Wearable Platform
Snapdragon X72 5G Modem-RF System
Snapdragon X75 5G Modem-RF System
SW5100
SW5100P
WCD9340
WCD9341
WCD9360
WCD9370
WCN3660B
WCN3680B
WCN3950
WCN3980
WCN3988
WSA8810
WSA8815
WSA8830
WSA8835
SDX55
AR8035
C-V2X 9150
FastConnect 7800
QCA6574A
QCA6584AU
QCA6595AU
QCA6696
QCA6698AQ
QCA8081
QCA8337
QCC710
QCN6224
QCN6274
QCS410
QCS610
QFW7114
QFW7124
Qualcomm Video Collaboration VC1 Platform
Qualcomm Video Collaboration VC3 Platform
Snapdragon Auto 5G Modem-RF
Snapdragon Auto 5G Modem-RF Gen 2
Snapdragon W5+ Gen 1 Wearable Platform
Snapdragon X72 5G Modem-RF System
Snapdragon X75 5G Modem-RF System
SW5100
SW5100P
WCD9340
WCD9341
WCD9360
WCD9370
WCN3660B
WCN3680B
WCN3950
WCN3980
WCN3988
WSA8810
WSA8815
WSA8830
WSA8835
SDX55
Detailed vulnerability description
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Qualcomm IPC. A local application can execute arbitrary code.
How to mitigate CVE-2024-38401
Install security update from vendor's website.