CVE-2023-33058

Buffer Copy Without Checking Size of Input in Modem

Information disclosure in Modem while processing SIB5.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 91 more

CVE-2023-33056

NULL Pointer dereference in WLAN Firmware

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 229 more

CVE-2023-33048

Buffer over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing t2lm buffers.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 229 more

CVE-2023-33045

Buffer Copy Without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 262 more

CVE-2023-33041

Reachable assertion in WLAN Firmware

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 251 more

CVE-2023-28574

Improper Input Validation in Core

Memory corruption in core services when Diag handler receives a command to configure event listeners.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Qam8255p and 153 more

CVE-2023-28553

Buffer Over-read in WLAN Host

Information Disclosure in WLAN Host when processing WMI event command.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 285 more

CVE-2024-33014

Buffer Over-read in WLAN Host

Transient DOS while parsing ESP IE from beacon/probe response frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 860 Mobile Platform and 650 more

CVE-2024-33015

Buffer Over-read in WLAN Host

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 390 more

CVE-2024-33024

Integer Overflow or Wraparound in WLAN Host

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 361 more

CVE-2024-33018

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 300 more

CVE-2024-33026

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 329 more

CVE-2024-33022

Integer Overflow or Wraparound in Automotive GPU

Memory corruption while allocating memory in HGSL driver.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 248 more

CVE-2024-33021

Use of Uninitialized Variable in Automotive GPU

Memory corruption while processing IOCTL call to set metainfo.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 276 more

CVE-2024-33020

Buffer Over-read in WLAN HOST

Transient DOS while processing TID-to-link mapping IE elements.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 195 more

CVE-2024-33019

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping action frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 296 more

CVE-2024-33028

Use After Free in Automotive Telematics

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 276 more

CVE-2024-33031

Improper Input Validation in RIL

Memory corruption while processing the update SIM PB records request.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 7800 and 29 more

CVE-2024-38424

Use After Free in GPS

Memory corruption during GNSS HAL process initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 237 more

CVE-2024-33030

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Performance

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6900 and 41 more