CVE-2024-38422 Integer Overflow to Buffer Overflow in Audio
An integer overflow in Qualcomm Snapdragon audio processing allows memory corruption and potential code execution via malicious voice packets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38422?
CVE-2024-38422 is a high-severity vulnerability in Qualcomm 315 5g Iot Modem Firmware, published on 4 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Weakness: CWE-680
Which versions are affected by CVE-2024-38422?
It affects 268 products.
Products include Qualcomm 205 Mobile Platform Firmware, Qualcomm 215 Mobile Platform Firmware, Qualcomm 315 5g Iot Modem Firmware, Qualcomm 9206 Lte Modem Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8064au Firmware and 262 more.
How do I fix CVE-2024-38422?
Apply the vendor's patch.
Is CVE-2024-38422 being exploited?
There is no known exploitation of CVE-2024-38422 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm 315 5g Iot Modem Firmware
Sources
Also known as 3794268, A-357616000, ASB-A-357616000, GHSA-3qgc-vrvv-mv2r.