CVE-2024-23350 Reachable Assertion in Multi Mode Call Processor
A reachable assertion in the Multi Mode Call Processor allows permanent denial of service when specific NAS transport payloads are received.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-23350?
CVE-2024-23350 is a medium-severity denial of service vulnerability in Qualcomm Ar8035 Firmware, published on 5 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
Weakness: CWE-617
Which versions are affected by CVE-2024-23350?
It affects 25 products.
Products include Qualcomm Ar8035 Firmware, Qualcomm Fastconnect 6900 Firmware, Qualcomm Fastconnect 7800 Firmware, Qualcomm Qca6174a Firmware, Qualcomm Qca6584au Firmware, Qualcomm Qca6698aq Firmware and 19 more.
How do I fix CVE-2024-23350?
No fix has been published for CVE-2024-23350 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-23350 being exploited?
There is no known exploitation of CVE-2024-23350 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Ar8035 Firmware
- CVE-2023-33106 Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset
- CVE-2024-45569 Improper Validation of Array Index in WLAN Host Communication
- CVE-2024-21473 Improper Input Validation in WIN SON
- CVE-2023-28582 Buffer Copy Without Checking Size of Input in Data Modem
- CVE-2023-43552 Use After Free in WLAN Host Communication
Sources
Also known as GHSA-jfgv-r9x2-7mhr.