CVE-2023-28572 Buffer Over-read in WLAN HOST
A buffer over-read in Qualcomm WLAN HOST allows attackers to cause memory corruption, potentially leading to code execution or denial of service on Android devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28572?
CVE-2023-28572 is a medium-severity memory corruption vulnerability in Qualcomm Csrb31024 Firmware, published on 7 Nov 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
Which versions are affected by CVE-2023-28572?
It affects 55 products.
Products include Qualcomm Csrb31024 Firmware, Qualcomm Fastconnect 6800 Firmware, Qualcomm Fastconnect 6900 Firmware, Qualcomm Fastconnect 7800 Firmware, Qualcomm Mdm9628 Firmware, Qualcomm Msm8996au Firmware and 49 more.
How do I fix CVE-2023-28572?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-28572 being exploited?
There is no known exploitation of CVE-2023-28572 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Csrb31024 Firmware
- CVE-2020-11236 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- CVE-2020-11237 Null dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- CVE-2024-43066 Use After Free in HLOS
- CVE-2020-11273 Null dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- CVE-2020-11186 Denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Sources
Also known as 3364303, A-280447210, GHSA-qq7m-q225-9v82, PUB-A-280447210.