CVE-2024-45580: High Severity Vulnerability in platform/vendor/qcom/opensource/dsp-kernel
Summary
CVE-2024-45580: ... Affects platform/vendor/qcom/opensource/dsp-kernel versions >= SoCVersion:0, < SoCVersion:2025-05-05. Fixed in SoCVersion:2025-05-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/vendor/qcom/opensource/dsp-kernel package is a critical component of the Android operating system, specifically designed for Qualcomm DSP (Digital Signal Processor) functionalities. This package facilitates efficient processing of audio, video, and other multimedia tasks, leveraging the capabilities of Qualcomm hardware. However, it is susceptible to vulnerabilities that can compromise system integrity and security.
Vulnerability Detail
CVE-2024-45580 is a high-severity vulnerability identified in the dsp-kernel package, which arises from improper handling of memory management in the fastrpc component. This flaw can lead to potential memory corruption, allowing attackers to execute arbitrary code or cause denial of service. The vulnerability was introduced in the SoC version 0 and has been fixed in the SoC version released on May 5, 2025. The technical implications of this vulnerability are significant, as it can affect the stability and security of devices utilizing this DSP kernel.
How To Fix
Minimum fixed version
SoCVersion:2025-05-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not feasible, consider implementing strict memory management practices in your application to mitigate the risks associated with this vulnerability. However, this is not a substitute for applying the official patch.
Conclusion
CVE-2024-45580 represents a significant security risk within the platform/vendor/qcom/opensource/dsp-kernel package. It is crucial for developers and system administrators to apply the available patch promptly to safeguard their systems against potential exploitation.
See every vulnerability recorded for platform/vendor/qcom/opensource/dsp-kernel →
FAQ
CVE-2024-45580 is a high-severity vulnerability in the dsp-kernel package that can lead to memory corruption and potential arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The consequences include potential system instability, unauthorized access, and execution of arbitrary code, which can compromise the security of the device.
Yes, a patch has been released for this vulnerability in the SoC version available as of May 5, 2025.
If immediate updating is not possible, implement strict memory management practices as a temporary workaround to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom/opensource/dsp-kernel.
