CVE-2024-33015: Buffer Over-read in WLAN Host
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmnto a version that resolves this vulnerability.Fixed in SoCVersion:2024-08-05
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33015?
CVE-2024-33015 has been classified as a transient denial of service vulnerability.
How do I fix CVE-2024-33015?
To mitigate CVE-2024-33015, it is advised to update the affected software to a version where the vulnerability is patched.
Which products are affected by CVE-2024-33015?
CVE-2024-33015 impacts various Qualcomm firmware implementations, including those for devices under the Android ecosystem.
What type of attack does CVE-2024-33015 facilitate?
CVE-2024-33015 enables attackers to induce denial of service through misconfigured parsing of SCAN RNR information elements.
Is CVE-2024-33015 exploitable remotely?
Yes, CVE-2024-33015 can potentially be exploited remotely if vulnerable devices are exposed to controlled network traffic.