CVE-2023-43512 Buffer Over-read in Qualcomm ESL
A buffer over-read in Qualcomm ESL allows attackers to cause a transient denial of service while parsing GATT service data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-43512?
CVE-2023-43512 is a high-severity denial of service vulnerability in Qualcomm Qcn7606 Firmware, published on 2 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
Which versions are affected by CVE-2023-43512?
It affects 1 product.
Products include Qualcomm Qcn7606 Firmware.
How do I fix CVE-2023-43512?
No fix has been published for CVE-2023-43512 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-43512 being exploited?
There is no known exploitation of CVE-2023-43512 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qcn7606 Firmware
Sources
Also known as GHSA-4q33-wj3r-p79q.