by Kastro
Paper/Archive/CVE-2023-21671

CVE-2023-21671

Qualcomm, Inc. Snapdragon — Improper Input Validation in Core

EPSS 0.1%CVSS 9.3
critical.is priorityof 100
29
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 3.5.035 × 200.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory Corruption in Core during syscall for Sectools Fuse comparison feature.

Affected

ProductAffectedFixed inSource
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonQCA6391–CNA
SnapdragonQCM6490–CNA
SnapdragonQCS6490–CNA
SnapdragonQSM8350–CNA
SnapdragonQualcomm Video Collaboration VC3 Platform–CNA
SnapdragonSD888–CNA
SnapdragonSM7315–CNA
SnapdragonSM7325P–CNA
SnapdragonSnapdragon 778G 5G Mobile Platform–CNA
SnapdragonSnapdragon 778G+ 5G Mobile Platform (SM7325-AE)–CNA

Scores by source

qualcomm (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refqualcomm.com/company/product-security/bulletins/november-2023-bulletin