Qualcomm zero-day under targeted exploitation (CVE-2024-43047)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-43047 | Use-After-Free in Qualcomm FastConnect and QCA Chipset Firmware CVE-2024-43047 is a use-after-free vulnerability (CWE-416) in the firmware of several Qualcomm connectivity chipsets and the QAM8295P automotive SoC, where maintaining memory maps of high-level operating system (HLOS) memory causes memory corruption. The flaw is scored with a local attack vector and low privileges required (CVSS 3.1: 7.8), so an attacker needs some local foothold, such as a malicious app on an Android device, and can then leverage the memory corruption for high-impact confidentiality, integrity, and availability effects, in practice a privilege escalation to system or kernel level. Anyone running devices built on the affected chips is exposed, including Android smartphones with FastConnect 6700/6800/6900/7800, devices using QCA-series Wi-Fi chips, and automotive platforms using the QAM8295P. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-08, and news reports describe targeted, limited Android attacks, though ransomware use is unknown and EPSS remains modest at 0.7%. Do: Apply Qualcomm's fix through your device or system OEM: install the latest Android security updates on affected phones, and update firmware/drivers for QCA-series Wi-Fi chips and the QAM8295P automotive SoC per vendor instructions; because this is a local firmware flaw, there is no user-side mitigation short of patching. Organizations under CISA KEV must remediate per the required action (apply vendor remediations or discontinue use). Prioritize an inventory of Android devices with FastConnect 6700/6800/6900/7800 and QCA6xxx/65xxx chips, noting this flaw is being used in targeted attacks rather than mass-scale campaigns. | 7.8 | <1% | KEV |
| massplausibly hundreds of millions of devices (affected Qualcomm FastConnect and QCA connectivity chips ship across Android smartphones, PCs with Qualcomm Wi-Fi… |
Full article267 words · extracted from helpnetsecurity.com · click to collapse
An actively exploited zero-day vulnerability (CVE-2024-43047) affecting dozens of Qualcomm’s chipsets has been patched by the American semiconductor giant.
About CVE-2024-43047
On Monday, Qualcomm has confirmed patches for 20 vulnerabilities affecting both proprietary and open source software running on its various chipsets.
Among those is CVE-2024-43047, a use-after-free vulnerability in the Digital Signal Processor (DSP) service that could lead to “memory corruption while maintaining memory maps of [high level operating system (HLOS)] memory.”
The vulnerability’s CVSS string shows that the vulnerability can be triggered by a local attacker with low privileges, with no user interaction required.
Seth Jenkins of Google Project Zero and Conghui Wang of Amnesty International Security Lab have been credited with reporting the vulnerability.
Jenkins confirmed that he found the issue in collaboration with Amnesty and Threat Analysis Group (TAG). Since both organizations are known for investigating mobile spyware targeting journalists, activists and dissidents, it seems likely that the vulnerability is being exploited by one or more commercial spyware makers.
“There are indications from Google Threat Analysis Group that CVE-2024-43047 may be under limited, targeted exploitation,” Qualcomm noted, and urged original equipment manufacturers to “deploy (…) patches on released devices as soon as possible.”
Jenkins also expressed hope that CVE-2024-43047 will be patched on Android devices very soon. (The vulnerability hasn’t been mentioned in the Android Security Bulletin for October 2024.)
A year ago, Qualcomm has similarly warned about attackers exploiting three zero-day vulnerabilities in its Adreno GPU and Compute DSP drivers.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/10/08/cve-2024-43047/