Qualcomm Snapdragon Auto/Snapdragon Mobile up to X75 5G Modem-RF System DL NAS Transport assertion

Summaryinfo

A vulnerability classified as critical was found in Qualcomm Snapdragon Auto and Snapdragon Mobile. The impacted element is an unknown function of the component DL NAS Transport Handler. The manipulation results in assertion. This vulnerability was named CVE-2024-23350. The attack needs to be approached within the local network. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Qualcomm Snapdragon Auto and Snapdragon Mobile. It has been classified as critical. Affected is an unknown function of the component DL NAS Transport Handler. The manipulation with an unknown input leads to a assertion vulnerability. CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. This is going to have an impact on availability. CVE summarizes:

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.

The advisory is shared for download at docs.qualcomm.com. This vulnerability is traded as CVE-2024-23350 since 01/16/2024. The exploitability is told to be easy. The attack needs to approached within the local network. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Snapdragon Auto
• Snapdragon Mobile

Version

• 8 Gen 3 Mobile Platform
• AR8035
• Auto 5G Modem-RF Gen 2
• FastConnect 6900
• FastConnect 7800
• QCA6174A
• QCA6584AU
• QCA6698AQ
• QCA8081
• QCA8337
• QCC710
• QCN6224
• QCN6274
• QEP8111
• QFW7114
• QFW7124
• WCD9340
• WCD9390
• WCD9395
• WSA8840
• WSA8845
• WSA8845H
• X35 5G Modem-RF System
• X72 5G Modem-RF System
• X75 5G Modem-RF System

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion