CVE-2024-45580
Published: 03 March 2025
Summary
CVE-2024-45580 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Fastconnect 6900 Firmware. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Use After Free memory corruption vulnerability by requiring timely application of vendor-supplied patches for affected Qualcomm components.
Implements memory safeguards such as ASLR and DEP to protect against exploitation of Use After Free vulnerabilities during IOCTL handling from userspace.
Ensures monitoring of security advisories like Qualcomm's bulletin to identify and respond to CVE-2024-45580 in affected products.
NVD Description
Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
Deeper analysisAI
CVE-2024-45580 is a memory corruption vulnerability, classified under CWE-416 (Use After Free), occurring while handling multiple IOCTL calls from userspace for remote invocation. It affects Qualcomm components, as detailed in the vendor's security bulletin. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local exploitation.
A local attacker with low privileges can exploit this issue with low complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution, data tampering, or system crashes through the memory corruption triggered by the IOCTL handling.
Qualcomm's March 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html) provides details on affected products and recommends applying vendor-supplied patches to mitigate the vulnerability. Security practitioners should review the bulletin for specific firmware or driver updates applicable to their environments.
Details
- CWE(s)