CVE-2024-33027 Improper Access Control in Graphics Linux
A user-space app can gain kernel privileges to corrupt GPU page tables, enabling memory corruption and potential code execution on Qualcomm Snapdragon devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33027?
CVE-2024-33027 is a high-severity vulnerability in Qualcomm 315 5g Iot Modem Firmware, published on 5 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Weakness: CWE-284
Which versions are affected by CVE-2024-33027?
It affects 90 products.
Products include Qualcomm 205 Mobile Platform Firmware, Qualcomm 215 Mobile Platform Firmware, Qualcomm 315 5g Iot Modem Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm C-V2x 9150 Firmware and 84 more.
How do I fix CVE-2024-33027?
Apply the vendor's patch.
Is CVE-2024-33027 being exploited?
There is no known exploitation of CVE-2024-33027 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm 315 5g Iot Modem Firmware
Sources
Also known as 3697522, A-316373168, ASB-A-316373168, GHSA-qvm8-hj6f-mrgr.