CVE-2024-33060: Use After Free in DSP_Services
Summary
CVE-2024-33060: ... Affects :linux_kernel:Qualcomm versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is the DSP_Services in the Qualcomm Linux Kernel for the Android ecosystem. DSP_Services is responsible for providing services related to the Digital Signal Processor (DSP) on Qualcomm SoCs. It facilitates communication between the DSP and the main processor. This vulnerability affects the DSP_Services package and can potentially lead to a use-after-free vulnerability.
Vulnerability Detail
The use-after-free vulnerability in DSP_Services allows an attacker to access or manipulate memory after it has been freed. This can result in a variety of consequences, including the potential for remote code execution, privilege escalation, or denial of service attacks. The vulnerability originates from a specific function in the 'adsprpc.c' file of the DSP_Services package. The vulnerable function is 'fastrpc_init_create_static_process'. The vulnerability has been assigned the CVE identifier CVE-2024-33060.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The use-after-free vulnerability in DSP_Services poses a significant risk to Android devices utilizing the Qualcomm Linux Kernel. It is crucial to update to the fixed version of the kernel to mitigate the potential consequences of this vulnerability.
See every vulnerability recorded for :linux_kernel:Qualcomm →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and intentions. It could potentially lead to remote code execution, privilege escalation, or denial of service attacks.
All versions of the Qualcomm Linux Kernel prior to the version released on September 5, 2024, are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this report.
The only known mitigation is to update the Qualcomm Linux Kernel to the fixed version.
Yes, this vulnerability specifically affects Android devices running the Qualcomm Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:Qualcomm.
