#VU99676 Buffer over-read in Qualcomm products - CVE-2024-38403


Vulnerability identifier: #VU99676

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-38403

CWE-ID: CWE-126

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
AR8035
Mobile applications / Mobile firmware & hardware
FastConnect 6900
Mobile applications / Mobile firmware & hardware
FastConnect 7800
Mobile applications / Mobile firmware & hardware
QAM8255P
Mobile applications / Mobile firmware & hardware
QAM8650P
Mobile applications / Mobile firmware & hardware
QAM8775P
Mobile applications / Mobile firmware & hardware
QCA6554A
Mobile applications / Mobile firmware & hardware
QCA6564AU
Mobile applications / Mobile firmware & hardware
QCA6574
Mobile applications / Mobile firmware & hardware
QCA6574A
Mobile applications / Mobile firmware & hardware
QCA6584AU
Mobile applications / Mobile firmware & hardware
QCA6595
Mobile applications / Mobile firmware & hardware
QCA6595AU
Mobile applications / Mobile firmware & hardware
QCA6696
Mobile applications / Mobile firmware & hardware
QCA6698AQ
Mobile applications / Mobile firmware & hardware
QCA6777AQ
Mobile applications / Mobile firmware & hardware
QCA6787AQ
Mobile applications / Mobile firmware & hardware
QCA6797AQ
Mobile applications / Mobile firmware & hardware
QCA8081
Mobile applications / Mobile firmware & hardware
QCA8337
Mobile applications / Mobile firmware & hardware
QCC2073
Mobile applications / Mobile firmware & hardware
QCC2076
Mobile applications / Mobile firmware & hardware
QCC710
Mobile applications / Mobile firmware & hardware
QCM8550
Mobile applications / Mobile firmware & hardware
QCN6224
Mobile applications / Mobile firmware & hardware
QCN6274
Mobile applications / Mobile firmware & hardware
QFW7114
Mobile applications / Mobile firmware & hardware
QFW7124
Mobile applications / Mobile firmware & hardware
SA7255P
Mobile applications / Mobile firmware & hardware
SA7775P
Mobile applications / Mobile firmware & hardware
SA8255P
Mobile applications / Mobile firmware & hardware
SA8650P
Mobile applications / Mobile firmware & hardware
SA8775P
Mobile applications / Mobile firmware & hardware
SC8380XP
Mobile applications / Mobile firmware & hardware
SM8550P
Mobile applications / Mobile firmware & hardware
SM8635
Mobile applications / Mobile firmware & hardware
SM8750
Mobile applications / Mobile firmware & hardware
SM8750P
Mobile applications / Mobile firmware & hardware
Snapdragon 429 Mobile Platform
Mobile applications / Mobile firmware & hardware
Snapdragon 8 Gen 2 Mobile Platform
Mobile applications / Mobile firmware & hardware
Snapdragon 8 Gen 3 Mobile Platform
Mobile applications / Mobile firmware & hardware
Snapdragon 8+ Gen 2 Mobile Platform
Mobile applications / Mobile firmware & hardware
Snapdragon AR2 Gen 1 Platform
Mobile applications / Mobile firmware & hardware
Snapdragon Wear 4100+ Platform
Mobile applications / Mobile firmware & hardware
Snapdragon X72 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
Snapdragon X75 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
SSG2115P
Mobile applications / Mobile firmware & hardware
SSG2125P
Mobile applications / Mobile firmware & hardware
SXR1230P
Mobile applications / Mobile firmware & hardware
SXR2230P
Mobile applications / Mobile firmware & hardware
SXR2250P
Mobile applications / Mobile firmware & hardware
WCD9340
Mobile applications / Mobile firmware & hardware
WCD9370
Mobile applications / Mobile firmware & hardware
WCD9375
Mobile applications / Mobile firmware & hardware
WCD9380
Mobile applications / Mobile firmware & hardware
WCD9385
Mobile applications / Mobile firmware & hardware
WCD9390
Mobile applications / Mobile firmware & hardware
WCD9395
Mobile applications / Mobile firmware & hardware
WCN3610
Mobile applications / Mobile firmware & hardware
WCN3620
Mobile applications / Mobile firmware & hardware
WCN3660B
Mobile applications / Mobile firmware & hardware
WCN3680B
Mobile applications / Mobile firmware & hardware
WCN3980
Mobile applications / Mobile firmware & hardware
WCN6755
Mobile applications / Mobile firmware & hardware
WCN7860
Mobile applications / Mobile firmware & hardware
WCN7861
Mobile applications / Mobile firmware & hardware
WCN7880
Mobile applications / Mobile firmware & hardware
WCN7881
Mobile applications / Mobile firmware & hardware
WSA8830
Mobile applications / Mobile firmware & hardware
WSA8835
Mobile applications / Mobile firmware & hardware
WSA8840
Mobile applications / Mobile firmware & hardware
WSA8845
Mobile applications / Mobile firmware & hardware
WSA8845H
Mobile applications / Mobile firmware & hardware
QCA6574AU
Hardware solutions / Firmware
SA8620P
Hardware solutions / Firmware
SA9000P
Hardware solutions / Firmware
SDM429W
Hardware solutions / Firmware
WSA8832
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

AR8035: All versions

FastConnect 6900: All versions

FastConnect 7800: All versions

QAM8255P: All versions

QAM8650P: All versions

QAM8775P: All versions

QCA6554A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6584AU: All versions

QCA6595: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA6698AQ: All versions

QCA6777AQ: All versions

QCA6787AQ: All versions

QCA6797AQ: All versions

QCA8081: All versions

QCA8337: All versions

QCC2073: All versions

QCC2076: All versions

QCC710: All versions

QCM8550: All versions

QCN6224: All versions

QCN6274: All versions

QFW7114: All versions

QFW7124: All versions

SA7255P: All versions

SA7775P: All versions

SA8255P: All versions

SA8620P: All versions

SA8650P: All versions

SA8775P: All versions

SA9000P: All versions

SC8380XP: All versions

SDM429W: All versions

SM8550P: All versions

SM8635: All versions

SM8750: All versions

SM8750P: All versions

Snapdragon 429 Mobile Platform: All versions

Snapdragon 8 Gen 2 Mobile Platform: All versions

Snapdragon 8 Gen 3 Mobile Platform: All versions

Snapdragon 8+ Gen 2 Mobile Platform: All versions

Snapdragon AR2 Gen 1 Platform: All versions

Snapdragon Wear 4100+ Platform: All versions

Snapdragon X72 5G Modem-RF System: All versions

Snapdragon X75 5G Modem-RF System: All versions

SSG2115P: All versions

SSG2125P: All versions

SXR1230P: All versions

SXR2230P: All versions

SXR2250P: All versions

WCD9340: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCD9390: All versions

WCD9395: All versions

WCN3610: All versions

WCN3620: All versions

WCN3660B: All versions

WCN3680B: All versions

WCN3980: All versions

WCN6755: All versions

WCN7860: All versions

WCN7861: All versions

WCN7880: All versions

WCN7881: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

WSA8840: All versions

WSA8845: All versions

WSA8845H: All versions

External links
https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Google Android
Multiple vulnerabilities in Qualcomm chipsets