[ CVE-2023-33063 · Published 5 Dec 2023 ]
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-12-05
[ Description ]Official description
Memory corruption in DSP Services during a remote call from HLOS to DSP.
CISA: Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 26 Dec 2023): Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Patch on qualcomm.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- www.qualcomm.com/company/product-security/bulletins/december-2023-bulletinPatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource