CVE-2023-33030 Buffer Copy without Checking Size of Input in HLOS
Memory corruption in Qualcomm Snapdragon HLOS during PlayReady use-case allows attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33030?
CVE-2023-33030 is a critical memory corruption vulnerability in Qualcomm 315 5g Iot Modem Firmware, published on 2 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption in HLOS while running playready use-case.
Which versions are affected by CVE-2023-33030?
It affects 298 products.
Products include Qualcomm 315 5g Iot Modem Firmware, Qualcomm 9205 Lte Modem Firmware, Qualcomm 9206 Lte Modem Firmware, Qualcomm 9207 Lte Modem Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8037 Firmware and 292 more.
How do I fix CVE-2023-33030?
No fix has been published for CVE-2023-33030 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-33030 being exploited?
There is no known exploitation of CVE-2023-33030 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm 315 5g Iot Modem Firmware
- CVE-2023-33107 Qualcomm Multiple Chipsets Integer Overflow
- CVE-2023-33063 Qualcomm Multiple Chipsets Use-After-Free
- CVE-2025-27034 Improper Validation of Array Index in Multi-Mode Call Processor
- CVE-2023-22388 Use of Out-of-range Pointer Offset in Multi-mode Call Processor
- CVE-2023-28578 Improper Input Validation in Services
Sources
Also known as GHSA-rh7v-fmqc-c7rj.