CVE-2024-43047: Memory Corruption in HLOS Memory Map Handling
CVE-2024-43047 Published on October 7, 2024
Use After Free in DSP Service
Memory corruption while maintaining memory maps of HLOS memory.
Known Exploited Vulnerability
This Qualcomm Multiple Chipsets Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. .
The following remediation steps are recommended / required by October 29, 2024: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Vulnerability Analysis
CVE-2024-43047 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2024-43047 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2024-43047
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-43047 are published in these products:
Affected Versions
Qualcomm, Inc. Snapdragon:- Version FastConnect 6700 is affected.
- Version FastConnect 6800 is affected.
- Version FastConnect 6900 is affected.
- Version FastConnect 7800 is affected.
- Version QAM8295P is affected.
- Version QCA6174A is affected.
- Version QCA6391 is affected.
- Version QCA6426 is affected.
- Version QCA6436 is affected.
- Version QCA6574AU is affected.
- Version QCA6584AU is affected.
- Version QCA6595 is affected.
- Version QCA6595AU is affected.
- Version QCA6688AQ is affected.
- Version QCA6696 is affected.
- Version QCA6698AQ is affected.
- Version QCS410 is affected.
- Version QCS610 is affected.
- Version QCS6490 is affected.
- Version Qualcomm Video Collaboration VC1 Platform is affected.
- Version Qualcomm Video Collaboration VC3 Platform is affected.
- Version SA4150P is affected.
- Version SA4155P is affected.
- Version SA6145P is affected.
- Version SA6150P is affected.
- Version SA6155P is affected.
- Version SA8145P is affected.
- Version SA8150P is affected.
- Version SA8155P is affected.
- Version SA8195P is affected.
- Version SA8295P is affected.
- Version SD660 is affected.
- Version SD865 5G is affected.
- Version SG4150P is affected.
- Version Snapdragon 660 Mobile Platform is affected.
- Version Snapdragon 680 4G Mobile Platform is affected.
- Version Snapdragon 685 4G Mobile Platform (SM6225-AD) is affected.
- Version Snapdragon 8 Gen 1 Mobile Platform is affected.
- Version Snapdragon 865 5G Mobile Platform is affected.
- Version Snapdragon 865+ 5G Mobile Platform (SM8250-AB) is affected.
- Version Snapdragon 870 5G Mobile Platform (SM8250-AC) is affected.
- Version Snapdragon 888 5G Mobile Platform is affected.
- Version Snapdragon 888+ 5G Mobile Platform (SM8350-AC) is affected.
- Version Snapdragon Auto 5G Modem-RF is affected.
- Version Snapdragon Auto 5G Modem-RF Gen 2 is affected.
- Version Snapdragon X55 5G Modem-RF System is affected.
- Version Snapdragon XR2 5G Platform is affected.
- Version SW5100 is affected.
- Version SW5100P is affected.
- Version SXR2130 is affected.
- Version WCD9335 is affected.
- Version WCD9341 is affected.
- Version WCD9370 is affected.
- Version WCD9375 is affected.
- Version WCD9380 is affected.
- Version WCD9385 is affected.
- Version WCN3950 is affected.
- Version WCN3980 is affected.
- Version WCN3988 is affected.
- Version WCN3990 is affected.
- Version WSA8810 is affected.
- Version WSA8815 is affected.
- Version WSA8830 is affected.
- Version WSA8835 is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
- Before and including * is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.