CVE-2024-33045: Return of Stack Variable Address in Buses in Qualcomm Linux Kernel
Summary
CVE-2024-33045: ... Affects :linux_kernel:Qualcomm versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Qualcomm Linux Kernel is an open-source software package that is widely used in the Android ecosystem. It provides essential functionality for Qualcomm System-on-Chips (SoCs) used in various devices. The package includes drivers and controllers for different hardware components, including the Slimbus controller. The Slimbus controller is responsible for managing communication between different devices connected to the bus. The vulnerability described in this report affects the Slimbus controller driver in the Qualcomm Linux Kernel.
Vulnerability Detail
The vulnerability, identified as CVE-2024-33045, allows an attacker to obtain the address of a stack variable in the Slimbus controller driver. By exploiting this vulnerability, an attacker can potentially manipulate the stack and execute arbitrary code, leading to a variety of security issues. The vulnerability was introduced in the Qualcomm Linux Kernel prior to the SoCVersion of 2024-09-05. It has been fixed in the latest version of the kernel.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix provided by updating the Qualcomm Linux Kernel to the latest version.
Conclusion
The vulnerability in the Qualcomm Linux Kernel's Slimbus controller driver allows an attacker to obtain the address of a stack variable and potentially execute arbitrary code. To mitigate this risk, it is crucial to update the kernel to the latest version, which includes the necessary patches and security fixes. Regularly updating the kernel and following security advisories is essential to stay protected against potential vulnerabilities.
See every vulnerability recorded for :linux_kernel:Qualcomm →
FAQ
This vulnerability can allow an attacker to execute arbitrary code by manipulating the stack. It can lead to various security issues, including privilege escalation, information disclosure, and remote code execution.
Devices using the Qualcomm Linux Kernel prior to the SoCVersion of 2024-09-05 are affected by this vulnerability. It is important to update the kernel to the latest version to mitigate the risk.
There is no known exploit for this vulnerability at the time of this report. However, it is important to apply the fix as soon as possible to prevent potential exploitation.
There may be other vulnerabilities in the Qualcomm Linux Kernel that are not specifically mentioned in this report. It is recommended to regularly update the kernel and follow security advisories to stay protected against any potential vulnerabilities.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:Qualcomm.
