Double Free in Qualcomm products - CVE-2024-23379
Published: October 7, 2024
Vulnerability identifier: #VU98095
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-23379
CWE-ID: CWE-415
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Qualcomm
Affected software:
FastConnect 6900
FastConnect 7800
QAM8255P
QAM8650P
QAM8775P
QAMSRV1H
QAMSRV1M
QCA6310
QCA6320
QCA6584AU
QCA6698AQ
SA7255P
SA7775P
SA8255P
SA8650P
SA8770P
SA8775P
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 835 Mobile PC Platform
Snapdragon Auto 5G Modem-RF Gen 2
SRV1H
SRV1M
WCD9335
WCD9340
WCD9341
WCD9380
WCN3990
WSA8810
WSA8815
WSA8830
WSA8835
SA8620P
SA9000P
SD835
FastConnect 6900
FastConnect 7800
QAM8255P
QAM8650P
QAM8775P
QAMSRV1H
QAMSRV1M
QCA6310
QCA6320
QCA6584AU
QCA6698AQ
SA7255P
SA7775P
SA8255P
SA8650P
SA8770P
SA8775P
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 835 Mobile PC Platform
Snapdragon Auto 5G Modem-RF Gen 2
SRV1H
SRV1M
WCD9335
WCD9340
WCD9341
WCD9380
WCN3990
WSA8810
WSA8815
WSA8830
WSA8835
SA8620P
SA9000P
SD835
Detailed vulnerability description
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Services. A local privileged application can execute arbitrary code.
How to mitigate CVE-2024-23379
Install security update from vendor's website.