CVE-2024-21455 — Untrusted Pointer Dereference in DSP Service

Description (CNA)

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

Affected (CNA)

Vendor / product	Versions
Qualcomm, Inc. / Snapdragon	affected QAM8295P; affected QCA6584AU; affected QCA6595; affected QCA6688AQ; affected QCA6696; affected QCA6698AQ; affected QCM6125; affected QCS6125; affected Qualcomm Video Collaboration VC1 Platform; affected SA8295P; affected SG4150P; affected Snapdragon 680 4G Mobile Platform; affected Snapdragon 685 4G Mobile Platform (SM6225-AD); affected Snapdragon Auto 5G Modem-RF Gen 2; affected WCD9370; affected WCD9375; affected WCN3950; affected WCN3980; affected WSA8810; affected WSA8815

Vendor / product

Versions

Qualcomm, Inc. / Snapdragon

affected QAM8295P; affected QCA6584AU; affected QCA6595; affected QCA6688AQ; affected QCA6696; affected QCA6698AQ; affected QCM6125; affected QCS6125; affected Qualcomm Video Collaboration VC1 Platform; affected SA8295P; affected SG4150P; affected Snapdragon 680 4G Mobile Platform; affected Snapdragon 685 4G Mobile Platform (SM6225-AD); affected Snapdragon Auto 5G Modem-RF Gen 2; affected WCD9370; affected WCD9375; affected WCN3950; affected WCN3980; affected WSA8810; affected WSA8815

CWE

CWE-822

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.