CVE-2024-33039

Dec. 11, 2024, 4:15 p.m.

6.7
Medium

Description

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.

Product(s) Impacted

Vendor Product Versions
Qualcomm
  • Qam8255p Firmware
  • Qam8255p
  • Qam8650p Firmware
  • Qam8650p
  • Qam8775p Firmware
  • Qam8775p
  • Qamsrv1h Firmware
  • Qamsrv1h
  • Qamsrv1m Firmware
  • Qamsrv1m
  • Sa7255p Firmware
  • Sa7255p
  • Sa7775p Firmware
  • Sa7775p
  • Sa8255p Firmware
  • Sa8255p
  • Sa8620p Firmware
  • Sa8620p
  • Sa8650p Firmware
  • Sa8650p
  • Sa8770p Firmware
  • Sa8770p
  • Sa8775p Firmware
  • Sa8775p
  • Sa9000p Firmware
  • Sa9000p
  • Snapdragon W5\+ Gen 1 Wearable Platform Firmware
  • Snapdragon W5\+ Gen 1 Wearable Platform
  • Srv1h Firmware
  • Srv1h
  • Srv1m Firmware
  • Srv1m
  • Sw5100 Firmware
  • Sw5100
  • Sw5100p Firmware
  • Sw5100p
  • Wcn3980 Firmware
  • Wcn3980
  • Wcn3988 Firmware
  • Wcn3988
  • Wsa8830 Firmware
  • Wsa8830
  • Wsa8835 Firmware
  • Wsa8835
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-822
Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
o qualcomm qam8255p_firmware - / / / / / / /
h qualcomm qam8255p - / / / / / / /
o qualcomm qam8650p_firmware - / / / / / / /
h qualcomm qam8650p - / / / / / / /
o qualcomm qam8775p_firmware - / / / / / / /
h qualcomm qam8775p - / / / / / / /
o qualcomm qamsrv1h_firmware - / / / / / / /
h qualcomm qamsrv1h - / / / / / / /
o qualcomm qamsrv1m_firmware - / / / / / / /
h qualcomm qamsrv1m - / / / / / / /
o qualcomm sa7255p_firmware - / / / / / / /
h qualcomm sa7255p - / / / / / / /
o qualcomm sa7775p_firmware - / / / / / / /
h qualcomm sa7775p - / / / / / / /
o qualcomm sa8255p_firmware - / / / / / / /
h qualcomm sa8255p - / / / / / / /
o qualcomm sa8620p_firmware - / / / / / / /
h qualcomm sa8620p - / / / / / / /
o qualcomm sa8650p_firmware - / / / / / / /
h qualcomm sa8650p - / / / / / / /
o qualcomm sa8770p_firmware - / / / / / / /
h qualcomm sa8770p - / / / / / / /
o qualcomm sa8775p_firmware - / / / / / / /
h qualcomm sa8775p - / / / / / / /
o qualcomm sa9000p_firmware - / / / / / / /
h qualcomm sa9000p - / / / / / / /
o qualcomm snapdragon_w5\+_gen_1_wearable_platform_firmware - / / / / / / /
h qualcomm snapdragon_w5\+_gen_1_wearable_platform - / / / / / / /
o qualcomm srv1h_firmware - / / / / / / /
h qualcomm srv1h - / / / / / / /
o qualcomm srv1m_firmware - / / / / / / /
h qualcomm srv1m - / / / / / / /
o qualcomm sw5100_firmware - / / / / / / /
h qualcomm sw5100 - / / / / / / /
o qualcomm sw5100p_firmware - / / / / / / /
h qualcomm sw5100p - / / / / / / /
o qualcomm wcn3980_firmware - / / / / / / /
h qualcomm wcn3980 - / / / / / / /
o qualcomm wcn3988_firmware - / / / / / / /
h qualcomm wcn3988 - / / / / / / /
o qualcomm wsa8830_firmware - / / / / / / /
h qualcomm wsa8830 - / / / / / / /
o qualcomm wsa8835_firmware - / / / / / / /
h qualcomm wsa8835 - / / / / / / /

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html

Tags

CWE-822
product-security@qualcomm.com
2024-12-02
CVE-2024-33039

CVSS Score

6.7 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: Dec. 2, 2024, 11:15 a.m.
Last Modified: Dec. 11, 2024, 4:15 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

product-security@qualcomm.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.