by Kastro
Paper/Archive/CVE-2023-24855

CVE-2023-24855

Qualcomm, Inc. Snapdragon — Use of Out-of-range Pointer Offset in Modem

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.8.458 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption in Modem while processing security related configuration before AS Security Exchange.

Affected

ProductAffectedFixed inSource
SnapdragonAR8035–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQCA6391–CNA
SnapdragonQCA8081–CNA
SnapdragonQCA8337–CNA
SnapdragonQCC710–CNA
SnapdragonQCM4490–CNA
SnapdragonQCM6490–CNA
SnapdragonQCM8550–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqualcomm.com/company/product-security/bulletins/october-2023-bulletin