CVE-2024-45542
Published: 06 January 2025
Summary
CVE-2024-45542 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Qualcomm Aqt1000 Firmware. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific memory corruption flaw in the Qualcomm WLAN driver by identifying, prioritizing, and applying vendor patches as described in the January 2025 security bulletin.
Implements memory safeguards like non-executable memory, stack canaries, and ASLR to protect against stack-based buffer overflows and out-of-bounds writes triggered by malicious IOCTL calls.
Requires validation of IOCTL inputs from user-space to the WLAN driver to reject malformed board data that could cause memory corruption.
NVD Description
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
Deeper analysisAI
CVE-2024-45542 is a memory corruption vulnerability triggered when an IOCTL call is invoked from user-space to write board data to the WLAN driver. It is associated with CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write) and affects Qualcomm WLAN drivers. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-06.
A local attacker with low privileges can exploit this issue by crafting and sending a malicious IOCTL call to the WLAN driver from user-space. Successful exploitation leads to memory corruption, enabling high-impact effects on confidentiality, integrity, and availability, such as potential arbitrary code execution or system denial of service.
Qualcomm's January 2025 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html provides details on mitigation, including affected products and recommended patches.
Details
- CWE(s)