CVE-2024-53014: High Severity Vulnerability in platform/vendor/qcom/opensource/audio-kernel-ar Package
Summary
CVE-2024-53014: ... Affects platform/vendor/qcom/opensource/audio-kernel-ar versions >= SoCVersion:0, < SoCVersion:2025-03-05. Fixed in SoCVersion:2025-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/vendor/qcom/opensource/audio-kernel-ar package is an essential component of the Android ecosystem, primarily responsible for audio processing and management in Qualcomm hardware. This package enables various audio functionalities, ensuring high-quality sound output and input for devices. However, it is crucial to maintain the integrity and security of this package, as vulnerabilities can lead to significant risks in audio data handling and device performance.
Vulnerability Detail
The vulnerability identified as CVE-2024-53014 originates from improper handling of audio port mappings within the wcd937x and wcd938x codec drivers. This flaw can potentially allow an attacker to exploit the audio processing system, leading to unauthorized access to sensitive audio data or even remote code execution. The vulnerability is classified as high severity due to its potential impact on device security and user privacy.
How To Fix
Minimum fixed version
SoCVersion:2025-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the affected audio codecs in your application until the patch is applied. This can be done by modifying the audio configuration files to exclude the wcd937x and wcd938x codecs from being initialized.
Conclusion
In summary, CVE-2024-53014 presents a significant risk to the platform/vendor/qcom/opensource/audio-kernel-ar package, necessitating prompt action to mitigate potential threats. Users are encouraged to apply the patch and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for platform/vendor/qcom/opensource/audio-kernel-ar →
FAQ
CVE-2024-53014 is a high severity vulnerability in the platform/vendor/qcom/opensource/audio-kernel-ar package that affects audio processing in Qualcomm devices.
Exploitation of this vulnerability could lead to unauthorized access to audio data or remote code execution, compromising device security.
Yes, a patch is available as of March 5, 2025. It is recommended to update the package to the patched version.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just the gradle.lockfile.
