by Kastro
Paper/Archive/CVE-2023-43538

CVE-2023-43538

Qualcomm, Inc. Snapdragon — Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OS

EPSS 0.1%CVSS 9.3
critical.is priorityof 100
28
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 1.0.010 × 200.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

Affected

ProductAffectedFixed inSource
SnapdragonAQT1000–CNA
SnapdragonAR8035–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6800–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQAM8255P–CNA
SnapdragonQAM8295P–CNA
SnapdragonQAM8650P–CNA
SnapdragonQAM8775P–CNA
SnapdragonQCA6174A–CNA
SnapdragonQCA6310–CNA

Scores by source

qualcomm (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html