CVE-2024-53024
Published: 03 March 2025
Summary
CVE-2024-53024 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Qualcomm Qcs6490 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-53024 is a memory corruption vulnerability, classified under CWE-476 (NULL Pointer Dereference), occurring in the display driver during device detachment. It affects Qualcomm components, as detailed in their security bulletin. The vulnerability received a CVSS v3.1 base score of 7.8 (High), reflecting its potential severity with local access.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary code execution, data corruption, or system crashes within the unchanged scope (S:U).
Qualcomm's March 2025 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html provides details on affected products and recommended patches or mitigations for remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5795
Vulnerability details
Memory corruption in display driver while detaching a device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local NULL pointer dereference in kernel display driver enables low-priv arbitrary code execution or DoS, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the memory corruption vulnerability by requiring timely remediation through application of Qualcomm's patches for the NULL pointer dereference in the display driver.
Implements memory safeguards such as non-executable memory and address randomization to prevent arbitrary code execution from the display driver memory corruption.
Ensures secure error handling for NULL pointer dereferences during device detachment to avoid exploitable crashes or information disclosure.