OpenSSL DTLS IE Fragment DoS Vulnerability (Transient)
CVE-2023-33084 Published on March 4, 2024

Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing IE fragments from server during DTLS handshake.

NVD

Vulnerability Analysis

CVE-2023-33084 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

NONE

Availability Impact:

HIGH

Weakness Type

What is a Memory Leak Vulnerability?

The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions. In some languages, developers are responsible for tracking memory allocation and releasing the memory. If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.

CVE-2023-33084 has been classified to as a Memory Leak vulnerability or weakness.

Products Associated with CVE-2023-33084

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-33084 are published in these products:

Google Android

OpenSSL

Affected Versions

Qualcomm, Inc. Snapdragon:

Version AR8035 is affected.
Version FastConnect 6700 is affected.
Version FastConnect 6900 is affected.
Version FastConnect 7800 is affected.
Version QCA6584AU is affected.
Version QCA6698AQ is affected.
Version QCA8081 is affected.
Version QCA8337 is affected.
Version QCC710 is affected.
Version QCM4490 is affected.
Version QCM8550 is affected.
Version QCN6024 is affected.
Version QCN6224 is affected.
Version QCN6274 is affected.
Version QCN9024 is affected.
Version QCS4490 is affected.
Version QFW7114 is affected.
Version QFW7124 is affected.
Version SM8550P is affected.
Version Snapdragon 4 Gen 2 Mobile Platform is affected.
Version Snapdragon 8 Gen 2 Mobile Platform is affected.
Version Snapdragon 8 Gen 3 Mobile Platform is affected.
Version Snapdragon 8+ Gen 2 Mobile Platform is affected.
Version Snapdragon Auto 5G Modem-RF Gen 2 is affected.
Version Snapdragon X65 5G Modem-RF System is affected.
Version Snapdragon X75 5G Modem-RF System is affected.
Version WCD9340 is affected.
Version WCD9370 is affected.
Version WCD9380 is affected.
Version WCD9385 is affected.
Version WCD9390 is affected.
Version WCD9395 is affected.
Version WCN3950 is affected.
Version WCN3988 is affected.
Version WSA8810 is affected.
Version WSA8815 is affected.
Version WSA8830 is affected.
Version WSA8832 is affected.
Version WSA8835 is affected.
Version WSA8840 is affected.
Version WSA8845 is affected.
Version WSA8845H is affected.

qualcomm ar8035_firmware:

Before and including * is affected.

qualcomm fastconnect_6700_firmware:

Before and including * is affected.

qualcomm fastconnect_6900_firmware:

Before and including * is affected.

qualcomm fastconnect_7800_firmware:

Before and including * is affected.

qualcomm qca6584au_firmware:

Before and including * is affected.

qualcomm qca6698aq_firmware:

Before and including * is affected.

qualcomm qca8081_firmware:

Before and including * is affected.

qualcomm qca8337_firmware:

Before and including * is affected.

qualcomm qcc710_firmware:

Before and including * is affected.

qualcomm qcm4490_firmware:

Before and including * is affected.

qualcomm qcm8550_firmware:

Before and including * is affected.

qualcomm qcn6024_firmware:

Before and including * is affected.

qualcomm qcn6224_firmware:

Before and including * is affected.

qualcomm qcn6274_firmware:

Before and including * is affected.

qualcomm qcn9024_firmware:

Before and including * is affected.

qualcomm qcs4490_firmware:

Before and including * is affected.

qualcomm qfw7114_firmware:

Before and including * is affected.

qualcomm qfw7124_firmware:

Before and including * is affected.

qualcomm sm8550p_firmware:

Before and including * is affected.

qualcomm snapdragon_4_gen_2_mobile_platform_firmware:

Before and including * is affected.

qualcomm snapdragon_8_gen_2_mobile_platform_firmware:

Before and including * is affected.

qualcomm snapdragon_8_gen_3_mobile_platform_firmware:

Before and including * is affected.

qualcomm snapdragon_auto_5g_modem-rf_gen_2_firmware:

Before and including * is affected.

qualcomm snapdragon_x65_5g_modem-rf_system_firmware:

Before and including * is affected.

qualcomm snapdragon_x75_5g_modem-rf_system_firmware:

Before and including * is affected.

qualcomm wcd9340_firmware:

Before and including * is affected.

qualcomm wcd9370_firmware:

Before and including * is affected.

qualcomm wcd9380_firmware:

Before and including * is affected.

qualcomm wcd9385_firmware:

Before and including * is affected.

qualcomm wcd9390_firmware:

Before and including * is affected.

qualcomm wcd9395_firmware:

Before and including * is affected.

qualcomm wcn3950_firmware:

Before and including * is affected.

qualcomm wcn3988_firmware:

Before and including * is affected.

qualcomm wsa8810_firmware:

Before and including * is affected.

qualcomm wsa8815_firmware:

Before and including * is affected.

qualcomm wsa8830_firmware:

Before and including * is affected.

qualcomm wsa8832_firmware:

Before and including * is affected.

qualcomm wsa8835_firmware:

Before and including * is affected.

qualcomm wsa8840_firmware:

Before and including * is affected.

qualcomm wsa8845_firmware:

Before and including * is affected.

qualcomm wsa8845h_firmware:

Before and including * is affected.

Exploit Probability

EPSS

0.14%

Percentile

34.44%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

OpenSSL DTLS IE Fragment DoS Vulnerability (Transient)CVE-2023-33084 Published on March 4, 2024

Vulnerability Analysis

Weakness Type

What is a Memory Leak Vulnerability?

Products Associated with CVE-2023-33084

Affected Versions

Exploit Probability

OpenSSL DTLS IE Fragment DoS Vulnerability (Transient)
CVE-2023-33084 Published on March 4, 2024