CVE-2024-53012
Published: 03 March 2025
Summary
CVE-2024-53012 is a high-severity Improper Input Validation (CWE-20) vulnerability in Qualcomm Qam8255P Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces input validation mechanisms to prevent memory corruption from improper inputs to the clock device.
Provides memory protection features like bounds checking to mitigate out-of-bounds writes in the clock device.
Ensures timely identification, reporting, and patching of flaws such as this input validation vulnerability in Qualcomm clock device components.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption vulnerability with low privileges enables arbitrary code execution, directly mapping to exploitation for privilege escalation.
NVD Description
Memory corruption may occur due to improper input validation in clock device.
Deeper analysisAI
CVE-2024-53012 is a memory corruption vulnerability stemming from improper input validation (CWE-20) in the clock device, potentially leading to out-of-bounds writes (CWE-787). It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-03. The vulnerability affects components in Qualcomm products, as referenced in their security documentation.
A local attacker with low privileges can exploit this issue with low attack complexity and no user interaction required. Successful exploitation may result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution or system crashes through memory corruption in the clock device.
Qualcomm's March 2025 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html) details affected products and provides guidance on patches and mitigations for this vulnerability.
Details
- CWE(s)