[ CVE-2023-33106 · Published 5 Dec 2023 ]
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-12-05
[ Description ]Official description
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
CISA: Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 26 Dec 2023): Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Patch on qualcomm.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- www.qualcomm.com/company/product-security/bulletins/december-2023-bulletinPatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource