CVE-2024-45553
Published: 06 January 2025
Description
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Security Summary
CVE-2024-45553 is a memory corruption vulnerability classified under CWE-416 (use-after-free). It affects Qualcomm components, where process-specific maps added to a global list can lead to corruption if a map is removed from the global list while another thread is using it for a process-specific task. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on January 6, 2025.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation may result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system crashes through the memory corruption triggered by the race condition between threads.
The Qualcomm January 2025 security bulletin provides details on affected products and recommended mitigations or patches, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html.
Details
- CWE(s)