CVE-2024-43047: Memory Corruption in HLOS Memory Map Handling
CVE-2024-43047 Published on October 7, 2024

Use After Free in DSP Service
Memory corruption while maintaining memory maps of HLOS memory.

NVD

Known Exploited Vulnerability

This Qualcomm Multiple Chipsets Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. .

The following remediation steps are recommended / required by October 29, 2024: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Vulnerability Analysis

CVE-2024-43047 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2024-43047 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2024-43047

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-43047 are published in these products:

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Affected Versions

Qualcomm, Inc. Snapdragon: qualcomm fastconnect_6700_firmware: qualcomm fastconnect_6800_firmware: qualcomm fastconnect_6900_firmware: qualcomm fastconnect_7800_firmware: qualcomm qam8295p_firmware: qualcomm qca6174a_firmware: qualcomm qca6391_firmware: qualcomm qca6426_firmware: qualcomm qca6436_firmware: qualcomm qca6574au_firmware: qualcomm qca6584au_firmware: qualcomm qca6595_firmware: qualcomm qca6595au_firmware: qualcomm qca6688aq_firmware: qualcomm qca6696_firmware: qualcomm qca6698aq_firmware: qualcomm qcs410_firmware: qualcomm qcs610_firmware: qualcomm qcs6490_firmware: qualcomm_video_collaboration_vc1_platform_firmware: qualcomm_video_collaboration_vc3_platform_firmware: qualcomm sa4150p_firmware: qualcomm sa4155p_firmware: qualcomm sa6145p_firmware: qualcomm sa6150p_firmware: qualcomm sa6155p_firmware: qualcomm sa8145p_firmware: qualcomm sa8150p_firmware: qualcomm sa8155p_firmware: qualcomm sa8195p_firmware: qualcomm sa8295p_firmware: qualcomm sd660_firmware: qualcomm sd865_5g_firmware: qualcomm sg4150p_firmware: qualcomm snapdragon_660_mobile_platform_firmware: qualcomm snapdragon_680_4g_mobile_platform_firmware: qualcomm snapdragon_8_gen_1_mobile_platform_firmware: qualcomm snapdragon_865_5g_mobile_platform_firmware: qualcomm snapdragon_888_5g_mobile_platform_firmware: qualcomm snapdragon_auto_5g_modem-rf_firmware: qualcomm snapdragon_auto_5g_modem-rf_gen_2_firmware: qualcomm snapdragon_x55_5g_modem-rf_system_firmware: qualcomm snapdragon_xr2_5g_platform_firmware: qualcomm sw5100_firmware: qualcomm sw5100p_firmware: qualcomm sxr2130_firmware: qualcomm wcd9335_firmware: qualcomm wcd9341_firmware: qualcomm wcd9370_firmware: qualcomm wcd9375_firmware: qualcomm wcd9380_firmware: qualcomm wcd9385_firmware: qualcomm wcn3950_firmware: qualcomm wcn3980_firmware: qualcomm wcn3988_firmware: qualcomm wcn3990_firmware: qualcomm wsa8810_firmware: qualcomm wsa8815_firmware: qualcomm wsa8830_firmware: qualcomm wsa8835_firmware: qualcomm snapdragon_865\+_5g_firmware: qualcomm snapdragon_870_5g_mobile_platform_firmware: qualcomm snapdragon_888\+_5g_mobile_platform_firmware: qualcomm sm6225-ad_firmware:

Exploit Probability

EPSS
1.75%
Percentile
82.25%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.