Buffer over-read in Qualcomm products - CVE-2024-38403

Vulnerability identifier: #VU99676

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38403

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.

Snapdragon X75 5G Modem-RF System
WCD9380
WCD9375
WCD9370
WCD9340
SXR2250P
SXR2230P
SXR1230P
SSG2125P
SSG2115P
WCD9385
Snapdragon X72 5G Modem-RF System
Snapdragon Wear 4100+ Platform
Snapdragon AR2 Gen 1 Platform
Snapdragon 8+ Gen 2 Mobile Platform
Snapdragon 8 Gen 3 Mobile Platform
Snapdragon 8 Gen 2 Mobile Platform
Snapdragon 429 Mobile Platform
SM8750P
SM8750
WCN7860
WSA8845H
WSA8845
WSA8840
WSA8835
WSA8830
WCN7881
WCN7880
WCN7861
SM8635
WCN6755
WCN3980
WCN3680B
WCN3660B
WCN3620
WCN3610
WCD9395
WCD9390
QCA8081
QCA6797AQ
QCA6787AQ
QCA6777AQ
QCA6698AQ
QCA6696
QCA6595AU
QCA6595
QCA6584AU
QCA8337
QCA6574A
QCA6574
QCA6564AU
QCA6554A
QAM8775P
QAM8650P
QAM8255P
FastConnect 7800
FastConnect 6900
SA7255P
SM8550P
SC8380XP
SA8775P
SA8650P
SA8255P
SA7775P
AR8035
QFW7124
QFW7114
QCN6274
QCN6224
QCM8550
QCC710
QCC2076
QCC2073
WSA8832
QCA6574AU
SDM429W
SA9000P
SA8620P
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 12L 2024-11-05, 12 2024-11-05, 13 2024-11-05, 14 2024-11-05, 15 2024-11-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android