CVE-2024-33041
Published: 06 January 2025
Summary
CVE-2024-33041 is a medium-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Qualcomm Fastconnect 6900 Firmware. Its CVSS base score is 6.7 (Medium).
Operationally, ranked at the 14.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation of input parameters such as the number of fences in fence frame IOCTL calls to prevent memory corruption from invalid inputs.
Implements safeguards against memory corruption exploits like out-of-bounds writes and uninitialized pointer access triggered by unvalidated IOCTL parameters.
Requires timely identification, reporting, and patching of the specific flaw in Qualcomm fence frame IOCTL handling to remediate the vulnerability.
NVD Description
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Deeper analysisAI
CVE-2024-33041 is a memory corruption vulnerability arising from missing input parameter validation for the number of fences in fence frame IOCTL calls. It affects Qualcomm components and is linked to CWE-823 (Access of Uninitialized Pointer) and CWE-787 (Out-of-bounds Write). The vulnerability received a CVSS v3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-06.
The attack requires local access with high privileges, low complexity, and no user interaction. An attacker meeting these conditions can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system compromise through memory corruption.
The Qualcomm January 2025 Security Bulletin provides details on affected products and mitigation, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html.
Details
- CWE(s)