Qualcomm disclosed a critical vulnerability on New Year's Day that would allow remote attacks via malicious voice calls over LTE networks.
The January 2024 security bulletin lists a total of 26 vulnerabilities, including four critical vulnerabilities, affecting Qualcomm chipsets.
Patches have already been made available to original equipment manufacturers whose devices use Qualcomm chips, including those in the popular Snapdragon series.
Critical Qualcomm vulnerability poses risk when receiving calls over LTE. The most severe bug, tracked as CVE-2023-33025, has a CVSS score of 9.8, according to Qualcomm.
This vulnerability involves a classic buffer overflow flaw causing memory corruption in the data modem, which occurs during Voice-over-LTE calls when the Session Description Protocol body is non-standard.
SDP typically helps facilitate connection between two devices for a communication session, such as a VoLTE call, by providing certain session, media, timing and network information in a standardized format.
If a remote attacker can manipulate the SDP body with their own content and initiate a call in which the malicious SDP is processed by the receiving device's data modem, memory corruption in the modem could be leveraged by the attacker for remote code execution.
A Qualcomm spokesperson told SC Media that such exploitation, while possible, would be difficult to achieve, as the attacker would need to have control over the LTE network itself for the attack to work.
CVE-2023-33025 affects two dozen Qualcomm chipsets, including the Snapdragon 680 and Snapdragon 685 4G Mobile Platforms.
These chips are used in a range of smartphones and tablets including models in the Samsung Galaxy, Motorola Moto and Huwei Enjoy and Nova product series.
A Qualcomm spokesperson told SC Media that CVE-2023-33025 will be included in the January 2024 Android security bulletin Tuesday.
Three local access vulnerabilities are also labeled as critical, including one that could cause permanent DoS and two others resulting in memory corruption.
CVE-2023-33036, which was given a critical security rating by Qualcomm and high CVSS score of 7.1, causes permanent disruption of hypervisor software due to NULL pointer dereferencing.
The problem occurs when an untrusted virtual machine without Power State Coordination Interface support makes a PSCI call.
This vulnerability affects more than 100 chipsets, including many in the Snapdragon series.
CVE-2023-33030, given a CVSS score of 9.3, is another buffer overflow bug that results in memory corruption in the high-level operating system when running a Microsoft PlayReady use-case.
This vulnerability impacts more than 200 chipsets ranging from smartphone and computer chips to those used in wearables and other IoT devices.
Memory corruption in the ARM TrustZone Secure OS can occur when memory allocation is requested from the Trusted Application region.
Customers were notified about all these critical flaws on July 3, 2023, and all the bugs are addressed through software patches provided by Qualcomm.
The company advises users of devices containing affected chips to contact the device manufacturers for information about patching status and apply all available updates.
This Cyber News was published on packetstormsecurity.com. Publication date: Wed, 03 Jan 2024 15:43:04 +0000