CVE-2023-33031 Buffer Copy Without Checking Size of Input in Automotive Audio
Attacker can exploit memory corruption in Automotive Audio to execute code or escalate privileges on Qualcomm Snapdragon devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33031?
CVE-2023-33031 is a high-severity memory corruption vulnerability in Qualcomm Apq8009 Firmware, published on 7 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Which versions are affected by CVE-2023-33031?
It affects 165 products.
Products include Qualcomm Apq5053-Aa Firmware, Qualcomm Apq8009 Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8064au Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware and 159 more.
How do I fix CVE-2023-33031?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-33031 being exploited?
There is no known exploitation of CVE-2023-33031 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8009 Firmware
- CVE-2023-33079 Use of Out-of-range Pointer Offset in Audio
- CVE-2023-33087 Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core
- CVE-2023-33055 Buffer Copy Without Checking Size of Input in Audio
- CVE-2023-24850 Improper Validation of Array Index in HLOS
- CVE-2023-33034 Signed-to-unsigned conversion error in Audio
Sources
Also known as 3442627, A-290061915, ASB-A-290061915, GHSA-x4vh-ch66-jvcq.