Cyber Posture

CVE-2024-53029

High

Published: 03 March 2025

Published
03 March 2025
Modified
06 March 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-53029 is a high-severity Improper Input Validation (CWE-20) vulnerability in Qualcomm Qam8255P Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the improper input validation (CWE-20) root cause by requiring validation of guest VM-controlled buffers before processing on the host.

prevent

Implements memory safeguards such as protections against buffer overflows and out-of-bounds writes (CWE-787) to prevent memory corruption from guest inputs leading to code execution or crashes.

prevent

Requires timely patching of the specific Qualcomm flaw as detailed in the March 2025 security bulletin to eliminate the memory corruption vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
Why these techniques?

Memory corruption via guest-controlled buffer enables host escape (T1611) and local privilege escalation to arbitrary code execution (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine.

Deeper analysisAI

CVE-2024-53029 is a memory corruption vulnerability stemming from improper input validation (CWE-20) and out-of-bounds write (CWE-787) when reading a value from a buffer controlled by a Guest Virtual Machine. It affects Qualcomm components, as detailed in the March 2025 security bulletin. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high potential impact on confidentiality, integrity, and availability.

An attacker with local access and low privileges on the host system can exploit this issue with low complexity and no user interaction required. By controlling the Guest Virtual Machine's buffer, the attacker can trigger memory corruption on the host, potentially leading to arbitrary code execution, data tampering, or system crashes within the affected scope.

Qualcomm's March 2025 security bulletin provides details on the vulnerability, including affected products and recommended patches; practitioners should consult https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html for mitigation guidance and updates.

Details

CWE(s)

Affected Products

qualcomm
qam8255p firmware
all versions
qualcomm
qam8295p firmware
all versions
qualcomm
qam8620p firmware
all versions
qualcomm
qam8650p firmware
all versions
qualcomm
qam8775p firmware
all versions
qualcomm
qamsrv1h firmware
all versions
qualcomm
qamsrv1m firmware
all versions
qualcomm
qca6574au firmware
all versions
qualcomm
qca6595 firmware
all versions
qualcomm
qca6595au firmware
all versions
+16 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2024-53012Same product: Qualcomm Qam8255P
CVE-2024-53031Same product: Qualcomm Qam8255P
CVE-2024-53022Same product: Qualcomm Qam8255P
CVE-2024-53030Same product: Qualcomm Qam8255P
CVE-2024-49837Same product: Qualcomm Qam8255P
CVE-2024-53032Same product: Qualcomm Qam8255P
CVE-2025-47363Same product: Qualcomm Qam8255P
CVE-2024-53028Same product: Qualcomm Qam8255P
CVE-2025-47393Same product: Qualcomm Qam8255P
CVE-2024-43064Same product: Qualcomm Qam8255P

References