CVE-2024-53022
Published: 03 March 2025
Summary
CVE-2024-53022 is a high-severity Improper Input Validation (CWE-20) vulnerability in Qualcomm Qam8255P Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses CWE-20 improper input validation in primary-guest VM communication channels that triggers memory corruption.
Implements memory protections such as ASLR and DEP to block exploitation of CWE-787 out-of-bounds writes during VM interactions.
Isolates host and guest VM processes to contain the impact of memory corruption originating in inter-VM communication handlers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption via improper input validation enables privilege escalation from low-priv guest/primary VM context.
NVD Description
Memory corruption may occur during communication between primary and guest VM.
Deeper analysisAI
CVE-2024-53022 is a memory corruption vulnerability that may occur during communication between the primary and guest virtual machines. It is associated with CWE-20 (Improper Input Validation) and CWE-787 (Out-of-bounds Write), carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects components detailed in Qualcomm's security documentation.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized access to confidential data, modification of system integrity, and disruption of availability through memory corruption.
Qualcomm's March 2025 Security Bulletin provides details on affected products, patches, and mitigation guidance, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html.
Details
- CWE(s)