by Kastro
Paper/Archive/CVE-2023-33058

CVE-2023-33058

Qualcomm, Inc. Snapdragon — Buffer Copy Without Checking Size of Input in Modem

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 29.8.298 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Information disclosure in Modem while processing SIB5.

Affected

ProductAffectedFixed inSource
SnapdragonAR8035–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQCA6584AU–CNA
SnapdragonQCA6698AQ–CNA
SnapdragonQCA8081–CNA
SnapdragonQCA8337–CNA
SnapdragonQCC710–CNA
SnapdragonQCM4490–CNA
SnapdragonQCM8550–CNA
SnapdragonQCN6024–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
qualcomm (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refqualcomm.com/company/product-security/bulletins/february-2024-bulletin