CVE-2024-33057: Buffer Over-read in WLAN Host Cmn [Q-Case#07257701]
Summary
CVE-2024-33057: ... Affects platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn, which is part of the Android ecosystem. This package is responsible for WLAN host common functionality. It provides essential features for wireless communication on Qualcomm SoC devices. However, a vulnerability has been identified in this package that could lead to a buffer over-read issue.
Vulnerability Detail
The buffer over-read vulnerability in platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn can have severe consequences. It occurs due to improper handling of certain input data, which can result in reading beyond the boundaries of a buffer. This vulnerability can potentially be exploited by an attacker to access sensitive information or execute arbitrary code. The issue has been assigned the CVE identifier CVE-2024-33057.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The buffer over-read vulnerability in platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn poses a significant risk to devices utilizing Qualcomm SoC. It is crucial to update the package to the fixed version to mitigate the potential impact of this vulnerability.
See every vulnerability recorded for platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn →
FAQ
The vulnerability can allow an attacker to read beyond the boundaries of a buffer, potentially leading to unauthorized access to sensitive information or arbitrary code execution.
Devices utilizing Qualcomm SoC and the vulnerable version of the platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn package are affected.
No evidence of active exploitation has been reported at the time of this vulnerability disclosure.
The recommended mitigation is to update the package to the fixed version provided by the vendor.
For more information about this vulnerability, refer to the source link: [https://storage.googleapis.com/android-osv/ASB-A-344620215.json].
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn.
