CVE-2024-45561

CVE-2024-45561 is a memory corruption vulnerability, associated with CWE-126 (Buffer Over-read) and CWE-416 (Use After Free), that occurs while handling an IOCTL call from user-space to set latency level. It affects Qualcomm components, as documented in their public security resources.

The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a local attack vector with low attack complexity and low required privileges. A local attacker could exploit it by sending a specially crafted IOCTL call, potentially achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution in the context of the affected component.

Qualcomm's February 2025 security bulletin provides details on affected products and mitigation, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html.