VulnerabilityAnalyzed

CVE-2024-23370

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

MEDIUM 6.7EPSS 0.11%

Does this matter?

Lower severity and a low EPSS score (0.11%). Track it; it rarely justifies an emergency change on its own.

Description

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

CVSS 3.1: 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.11% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-416
Affected: qualcomm/wsa8835 firmware · qualcomm/wsa8830 firmware · qualcomm/wcn3988 firmware · qualcomm/wcn3980 firmware · qualcomm/sw5100p firmware · qualcomm/sw5100 firmware · qualcomm/snapdragon auto 5g modem-rf gen 2 firmware · qualcomm/qca9377 firmware · qualcomm/qca9367 firmware · qualcomm/qca6698aq firmware · qualcomm/qca6584au firmware
Source: product-security@qualcomm.com

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.