SB2024070153 - Multiple vulnerabilities in Qualcomm chipsets 



SB2024070153 - Multiple vulnerabilities in Qualcomm chipsets

Published: July 1, 2024

Security Bulletin ID SB2024070153
Severity
Medium
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 secuirty vulnerabilities.


1) Integer underflow (CVE-ID: CVE-2024-21466)

The vulnerability allows a remote attacker to read memory contents or crash the system.

The vulnerability exists due to improper input validation in WLAN Host Communication. A remote attacker can read memory contents or crash the system.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-21469)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in TZ Secure OS. A local application can execute arbitrary code.


3) Buffer over-read (CVE-ID: CVE-2024-21465)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Trusted Execution Environment. A local application can execute arbitrary code.


4) Buffer over-read (CVE-ID: CVE-2024-21462)

The vulnerability allows a local application to crash the entire system.

The vulnerability exists due to improper input validation in TZ Secure OS. A local application can crash the entire system.


5) Use of Insufficiently Random Values (CVE-ID: CVE-2024-21460)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper input validation in Core. A local application can gain access to sensitive information.


6) Memory corruption (CVE-ID: CVE-2023-43554)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in DSP Services. A local application can execute arbitrary code.


7) Double Free (CVE-ID: CVE-2024-21461)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in HLOS. A local application can execute arbitrary code.


8) Buffer over-read (CVE-ID: CVE-2024-21458)

The vulnerability allows a remote attacker to read memory contents or crash the system.

The vulnerability exists due to improper input validation in WLAN HOST. A remote attacker can read memory contents or crash the system.


9) Memory corruption (CVE-ID: CVE-2024-21482)

The vulnerability allows a local attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Linux Boot Loader. A local attacker can execute arbitrary code.


10) Buffer over-read (CVE-ID: CVE-2024-21457)

The vulnerability allows a remote attacker to read memory contents or crash the system.

The vulnerability exists due to improper input validation in WLAN Host Communication. A remote attacker can read memory contents or crash the system.


11) Buffer over-read (CVE-ID: CVE-2024-21456)

The vulnerability allows a remote attacker to read memory contents or crash the system.

The vulnerability exists due to improper input validation in WLAN HOST. A remote attacker can read memory contents or crash the system.


12) Use After Free (CVE-ID: CVE-2024-23380)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.


13) Use After Free (CVE-ID: CVE-2024-23373)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.


14) Integer overflow (CVE-ID: CVE-2024-23372)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.


15) Buffer overflow (CVE-ID: CVE-2024-23368)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Qualcomm IPC. A local application can execute arbitrary code.


Remediation

Install update from vendor's website.