CVE-2024-33041
Published: 06 January 2025
Description
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Security Summary
CVE-2024-33041 is a memory corruption vulnerability arising from missing input parameter validation for the number of fences in fence frame IOCTL calls. It affects Qualcomm components and is linked to CWE-823 (Access of Uninitialized Pointer) and CWE-787 (Out-of-bounds Write). The vulnerability received a CVSS v3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-06.
The attack requires local access with high privileges, low complexity, and no user interaction. An attacker meeting these conditions can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system compromise through memory corruption.
The Qualcomm January 2025 Security Bulletin provides details on affected products and mitigation, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html.
Details
- CWE(s)