CVE-2023-33106 Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset
An attacker can exploit memory corruption in the GPU driver to execute arbitrary code or escalate privileges on Android devices using Qualcomm Snapdragon chips.
- Exploited in the wild
- Since 5 Dec 2023
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33106?
CVE-2023-33106 is a high-severity memory corruption vulnerability in Qualcomm Ar8035 Firmware, published on 5 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Which versions are affected by CVE-2023-33106?
It affects 153 products.
Products include Qualcomm Ar8035 Firmware, Qualcomm Csra6620 Firmware, Qualcomm Csra6640 Firmware, Qualcomm Fastconnect 6200 Firmware, Qualcomm Fastconnect 6700 Firmware, Qualcomm Fastconnect 6800 Firmware and 147 more.
How do I fix CVE-2023-33106?
Apply the vendor's patch. US federal agencies must fix it by 26 Dec 2023.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-33106 being exploited?
Yes. Attackers have exploited CVE-2023-33106 in the wild since at least 5 Dec 2023.
Other vulnerabilities in Qualcomm Ar8035 Firmware
- CVE-2024-45569 Improper Validation of Array Index in WLAN Host Communication
- CVE-2024-21473 Improper Input Validation in WIN SON
- CVE-2023-28582 Buffer Copy Without Checking Size of Input in Data Modem
- CVE-2023-43552 Use After Free in WLAN Host Communication
- CVE-2023-43553 Use of Out-of-range Pointer Offset in WLAN HOST
Sources
Also known as 3612841, A-300941008, ASB-A-300941008, GHSA-x563-8qf7-q64m.