Double Free in Qualcomm products - CVE-2024-23379
Published: October 7, 2024
Vulnerability identifier: #VU98095
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-23379
CWE-ID: CWE-415
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Services. A local privileged application can execute arbitrary code.
Affected software
WCD9340
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 835 Mobile PC Platform
Snapdragon Auto 5G Modem-RF Gen 2
SRV1H
SRV1M
WCD9335
SA8775P
WCD9341
WCD9380
WCN3990
WSA8810
WSA8815
WSA8830
WSA8835
QCA6584AU
FastConnect 7800
QAM8255P
QAM8650P
QAM8775P
QAMSRV1H
QAMSRV1M
QCA6310
QCA6320
FastConnect 6900
QCA6698AQ
SA7255P
SA7775P
SA8255P
SA8650P
SA8770P
SA9000P
SD835
SA8620P
Snapdragon 8 Gen 1 Mobile Platform
Snapdragon 835 Mobile PC Platform
Snapdragon Auto 5G Modem-RF Gen 2
SRV1H
SRV1M
WCD9335
SA8775P
WCD9341
WCD9380
WCN3990
WSA8810
WSA8815
WSA8830
WSA8835
QCA6584AU
FastConnect 7800
QAM8255P
QAM8650P
QAM8775P
QAMSRV1H
QAMSRV1M
QCA6310
QCA6320
FastConnect 6900
QCA6698AQ
SA7255P
SA7775P
SA8255P
SA8650P
SA8770P
SA9000P
SD835
SA8620P
How to mitigate CVE-2024-23379
Install security update from vendor's website.