CVE-2024-43047
Published: 07 October 2024
Summary
CVE-2024-43047 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Fastconnect 6700 Firmware. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 15.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis
CVE-2024-43047 is a use-after-free vulnerability (CWE-416) that produces memory corruption during maintenance of HLOS memory maps. The flaw resides in Qualcomm components responsible for managing these mappings and carries a CVSS 3.1 score of 7.8 with local attack vector, low complexity, and no user interaction required.
A local attacker with low privileges can trigger the flaw to corrupt memory and obtain high-impact effects on confidentiality, integrity, and availability, typically resulting in arbitrary code execution or elevation of privileges on the affected device.
Qualcomm’s October 2024 security bulletin addresses the issue with patches for impacted chipsets and firmware; the vulnerability also appears in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation. EPSS remains low (current 0.0175, peak 0.0234) with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40024
Vulnerability details
Memory corruption while maintaining memory maps of HLOS memory.
- CWE(s)
- KEV Date Added
- 08 October 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.