SB2024010101 - Multiple vulnerabilities in Qualcomm chipsets
Published: January 1, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 26 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2023-33014)
The vulnerability allows a local attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in Services. A local attacker can execute arbitrary code.
2) Use After Free (CVE-ID: CVE-2023-43514)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Services. A local application can execute arbitrary code.
3) Buffer overflow (CVE-ID: CVE-2023-33113)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Kernel. A local application can execute arbitrary code.
4) Use After Free (CVE-ID: CVE-2023-33094)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux Graphics. A local application can execute arbitrary code.
5) Buffer overflow (CVE-ID: CVE-2023-33085)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Wearables. A local application can execute arbitrary code.
6) Buffer over-read (CVE-ID: CVE-2023-43512)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Qualcomm ESL. A remote attacker can perform a denial of service (DoS) attack.
7) Loop with Unreachable Exit Condition ('Infinite Loop') (CVE-ID: CVE-2023-43511)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
8) Buffer over-read (CVE-ID: CVE-2023-33116)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host. A remote attacker can perform a denial of service (DoS) attack.
9) Buffer over-read (CVE-ID: CVE-2023-33112)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
10) NULL Pointer Dereference (CVE-ID: CVE-2023-33109)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
11) Buffer over-read (CVE-ID: CVE-2023-33062)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
12) Buffer over-read (CVE-ID: CVE-2023-33040)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Data Modem. A remote attacker can perform a denial of service (DoS) attack.
13) NULL Pointer Dereference (CVE-ID: CVE-2023-33036)
The vulnerability allows a local application to crash the entire system.
The vulnerability exists due to improper input validation in Hypervisor. A local application can crash the entire system.
14) Buffer overflow (CVE-ID: CVE-2023-33030)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in HLOS. A local application can execute arbitrary code.
15) Buffer overflow (CVE-ID: CVE-2023-33025)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in Data Modem. A remote attacker can execute arbitrary code.
16) Integer overflow (CVE-ID: CVE-2023-33038)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Radio Interface Layer. A local privileged application can execute arbitrary code.
17) Use After Free (CVE-ID: CVE-2023-33114)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Neural Processing Unit. A local application can execute arbitrary code.
18) Double Free (CVE-ID: CVE-2023-28583)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Data Network Stack & Connectivity. A local privileged application can execute arbitrary code.
19) Use After Free (CVE-ID: CVE-2023-33108)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.
20) Cryptographic Issues (CVE-ID: CVE-2023-33037)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Automotive. A local application can read and manipulate data.
21) Use After Free (CVE-ID: CVE-2023-33120)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
22) Use After Free (CVE-ID: CVE-2023-33118)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a request for Listen Sound session get parameter from ST HAL in Automotive Audio. A local application can execute arbitrary code.
23) Use After Free (CVE-ID: CVE-2023-33117)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
24) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2023-33110)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
25) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2023-33033)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
26) Integer overflow (CVE-ID: CVE-2023-33032)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in TZ Secure OS. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.