CVE-2024-21464
Published: 06 January 2025
Summary
CVE-2024-21464 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Qualcomm Fastconnect 6700 Firmware. Its CVSS base score is 8.4 (High).
Operationally, ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the memory corruption vulnerability by requiring timely application of vendor-provided patches as specified in Qualcomm's security bulletin.
Implements memory protection mechanisms such as ASLR, DEP, and stack canaries to prevent exploitation of memory corruption like CWE-120 even if unpatched.
Requires validation of inputs to IPA statistics processing to avoid buffer overflows or corruption when no active clients are registered.
NVD Description
Memory corruption while processing IPA statistics, when there are no active clients registered.
Deeper analysisAI
CVE-2024-21464 is a memory corruption vulnerability (CWE-120) that occurs while processing IPA statistics when there are no active clients registered. It affects Qualcomm software components, as detailed in the vendor's security bulletin. The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with no privileges can exploit this vulnerability through low-complexity means without requiring user interaction. Successful exploitation enables high-impact outcomes, including unauthorized access to confidential data, modification of system integrity, and disruption of availability, potentially leading to arbitrary code execution or system compromise.
Qualcomm's January 2025 security bulletin provides details on affected products and recommends applying the available patches or updates to mitigate the issue, accessible at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html.
Details
- CWE(s)