CVE-2023-33107 Qualcomm Multiple Chipsets Integer Overflow
An integer overflow in Qualcomm Graphics Linux allows memory corruption during IOCTL calls, potentially enabling code execution or privilege escalation on Android devices.
- Exploited in the wild
- Since 5 Dec 2023
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33107?
CVE-2023-33107 is a high-severity vulnerability in Qualcomm 315 5g Iot Modem Firmware, published on 5 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Weakness: CWE-190
Which versions are affected by CVE-2023-33107?
It affects 242 products.
Products include Qualcomm 315 5g Iot Modem Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8064au Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware and 236 more.
How do I fix CVE-2023-33107?
Apply the vendor's patch. US federal agencies must fix it by 26 Dec 2023.
Is CVE-2023-33107 being exploited?
Yes. Attackers have exploited CVE-2023-33107 in the wild since at least 5 Dec 2023.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Qualcomm 315 5g Iot Modem Firmware
- CVE-2023-33063 Qualcomm Multiple Chipsets Use-After-Free
- CVE-2025-27034 Improper Validation of Array Index in Multi-Mode Call Processor
- CVE-2023-22388 Use of Out-of-range Pointer Offset in Multi-mode Call Processor
- CVE-2023-28578 Improper Input Validation in Services
- CVE-2023-33072 Buffer copy without checking size of Input in Core
Sources
Also known as 3611296, A-299649795, ASB-A-299649795, GHSA-wg3g-ggh3-7wgp.