CVE-2024-45584

CVE-2024-45584 is a memory corruption vulnerability associated with CWE-822 (Untrusted Pointer Dereference) and CWE-119 (Buffer Overflow). It occurs when a compatibility IOCTL call is followed by a normal IOCTL call from userspace. The vulnerability affects Qualcomm products, as outlined in their February 2025 security bulletin, and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It was published on 2025-02-03.

A local attacker with low privileges can exploit this issue with low attack complexity and no user interaction. Exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential arbitrary code execution, data tampering, or denial of service within the affected system scope.

The Qualcomm February 2025 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html provides details on mitigation, including identification of affected products and recommended patches or updates.