Qualcomm Snapdragon Auto up to WSA8835 Haptics Effects Pattern stack-based overflow

Summaryinfo

A vulnerability has been found in Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile and Snapdragon Wearables and classified as critical. Impacted is an unknown function of the component Haptics Effects Pattern Handler. Performing a manipulation results in stack-based overflow. This vulnerability is identified as CVE-2024-23374. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile and Snapdragon Wearables. This affects an unknown part of the component Haptics Effects Pattern Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.

It is possible to read the advisory at docs.qualcomm.com. This vulnerability is uniquely identified as CVE-2024-23374 since 01/16/2024. The exploitability is told to be easy. Attacking locally is a requirement. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/17/2024).

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Chip Software

Vendor

• Qualcomm

Name

• Snapdragon Auto
• Snapdragon Connectivity
• Snapdragon Industrial IOT
• Snapdragon Mobile
• Snapdragon Wearables

Version

• 8 Gen 1 Mobile Platform
• Auto 5G Modem-RF Gen 2
• FastConnect 6900
• FastConnect 7800
• QCA6174A
• QCA6574AU
• QCA6584AU
• QCA6696
• QCA6698AQ
• QCA9367
• QCA9377
• SA6145P
• SA6150P
• SA6155P
• SA8145P
• SA8150P
• SA8155P
• SA8195P
• SW5100
• SW5100P
• W5+ Gen 1 Wearable Platform
• WCD9380
• WCN3980
• WCN3988
• WSA8830
• WSA8835

License

• commercial

Website

• Vendor: https://www.qualcomm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion