CVE-2024-33043: Buffer Over-read in FMHost
Summary
CVE-2024-33043: ... Affects platform/vendor/qcom-opensource/fm-commonsys versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FMHost package, part of the fm-commonsys vendor package in the Android ecosystem, provides functionality related to FM radio on Qualcomm Snapdragon SoCs. It is responsible for handling various FM radio operations and communication with the hardware. This package is vulnerable to a buffer over-read issue.
Vulnerability Detail
The buffer over-read vulnerability in FMHost allows an attacker to read data beyond the bounds of an allocated buffer. This can lead to the exposure of sensitive information or the execution of arbitrary code. The vulnerability originates from a flaw in the 'hci_ev_program_service' function in the 'helium/radio_helium_hal.c' file. By exploiting this vulnerability, an attacker can potentially gain unauthorized access to sensitive data or execute malicious code on the affected system.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The buffer over-read vulnerability in FMHost poses a significant risk to the security and integrity of the affected systems. It is crucial to update the FMHost package to the fixed version to mitigate the potential exploitation of this vulnerability.
See every vulnerability recorded for platform/vendor/qcom-opensource/fm-commonsys →
FAQ
This vulnerability can potentially lead to the exposure of sensitive information or the execution of arbitrary code on the affected system.
There is no known exploit available for this vulnerability at the moment.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network.
No, only versions prior to the fixed version released on September 5, 2024, are affected by this vulnerability.
Yes, this vulnerability has been assigned the CVE identifier CVE-2024-33043.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom-opensource/fm-commonsys.
