CVE-2024-33041
Published: 06 January 2025
Summary
CVE-2024-33041 is a medium-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Qualcomm Fastconnect 6900 Firmware. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-33041 is a memory corruption vulnerability arising from missing input parameter validation for the number of fences in fence frame IOCTL calls. It affects Qualcomm components and is linked to CWE-823 (Access of Uninitialized Pointer) and CWE-787 (Out-of-bounds Write). The vulnerability received a CVSS v3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-06.
The attack requires local access with high privileges, low complexity, and no user interaction. An attacker meeting these conditions can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system compromise through memory corruption.
The Qualcomm January 2025 Security Bulletin provides details on affected products and mitigation, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-30786
Vulnerability details
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption in Qualcomm IOCTL handling enables privilege escalation via out-of-bounds write and uninitialized pointer access, directly mapping to exploitation for local privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation of input parameters such as the number of fences in fence frame IOCTL calls to prevent memory corruption from invalid inputs.
Implements safeguards against memory corruption exploits like out-of-bounds writes and uninitialized pointer access triggered by unvalidated IOCTL parameters.
Requires timely identification, reporting, and patching of the specific flaw in Qualcomm fence frame IOCTL handling to remediate the vulnerability.