by Kastro
Paper/Archive/CVE-2024-38408

CVE-2024-38408

Qualcomm, Inc. Snapdragon — Cryptographic Issues in BT Controller

EPSS 0.1%CVSS 9.1
critical.is priorityof 100
28
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 3.7.037 × 200.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Affected

ProductAffectedFixed inSource
Snapdragon315 5G IoT Modem–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8035–CNA
SnapdragonCSRB31024–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6800–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonFlight RB5 5G Platform–CNA
SnapdragonImmersive Home 214 Platform–CNA
SnapdragonImmersive Home 216 Platform–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
qualcomm (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdocs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html