CVE-2024-38412
Published: 03 February 2025
Description
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
Security Summary
CVE-2024-38412 is a memory corruption vulnerability classified under CWE-416 (Use After Free), occurring while invoking IOCTL calls from user-space to kernel-space to handle session errors. It affects Qualcomm components, as documented in their security advisories.
The vulnerability carries a CVSS v3.1 base score of 6.6 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). A local attacker with low privileges can exploit it with low attack complexity and no user interaction required. Successful exploitation enables low-impact confidentiality and availability violations alongside high-impact integrity violations, potentially allowing data tampering or limited code execution in kernel space.
Qualcomm's February 2025 security bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html, details affected products and recommends applying available patches for mitigation.
Details
- CWE(s)