CVE-2024-33038: Untrusted Pointer Dereference in Computer Vision
Published Sep 1, 2024
·Updated
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Affected Software
92 affected componentsFixes available
All of the following
Qualcomm Fastconnect 6700 Firmware
Qualcomm Fastconnect 6700
All of the following
Qualcomm Fastconnect 6900 Firmware
Qualcomm Fastconnect 6900
All of the following
Qualcomm Fastconnect 7800 Firmware
Qualcomm Fastconnect 7800
All of the following
Qualcomm Qcm4490 Firmware
Qualcomm Qcm4490
All of the following
Qualcomm Qcm5430 Firmware
Qualcomm Qcm5430
All of the following
Qualcomm Qcm6490 Firmware
Qualcomm Qcm6490
All of the following
Qualcomm Qcm8550 Firmware
Qualcomm Qcm8550
All of the following
Qualcomm Qcs4490 Firmware
Qualcomm Qcs4490
All of the following
Qualcomm Qcs5430 Firmware
Qualcomm Qcs5430
All of the following
Qualcomm Qcs6490 Firmware
Qualcomm Qcs6490
All of the following
Qualcomm Qcs8550 Firmware
Qualcomm Qcs8550
All of the following
Qualcomm Video Collaboration Vc3 Platform Firmware
Qualcomm Video Collaboration Vc3 Platform
All of the following
Qualcomm Sd 8 Gen1 5g Firmware
Qualcomm Sd 8 Gen1 5g
All of the following
Qualcomm Sg8275p Firmware
Qualcomm Sg8275p
All of the following
Qualcomm Sm8550p Firmware
Qualcomm Sm8550p
All of the following
Qualcomm Sm8635 Firmware
Qualcomm Sm8635
All of the following
Qualcomm Snapdragon 4 Gen 2 Firmware
Qualcomm Snapdragon 4 Gen 2
All of the following
Qualcomm Snapdragon 8 Gen 1 Firmware
Qualcomm Snapdragon 8 Gen 1
All of the following
Qualcomm Snapdragon 8 Gen 2 Firmware
Qualcomm Snapdragon 8 Gen 2
All of the following
Qualcomm Snapdragon 8 Gen 3 Firmware
Qualcomm Snapdragon 8 Gen 3
All of the following
Qualcomm Snapdragon 8\+ Gen 1 Firmware
Qualcomm Snapdragon 8\+ Gen 1
All of the following
Qualcomm Snapdragon 8\+ Gen 2 Firmware
Qualcomm Snapdragon 8\+ Gen 2
All of the following
Qualcomm Snapdragon Ar2 Gen 1 Firmware
Qualcomm Snapdragon Ar2 Gen 1
All of the following
Qualcomm Ssg2115p Firmware
Qualcomm Ssg2115p
All of the following
Qualcomm Ssg2125p Firmware
Qualcomm Ssg2125p
All of the following
Qualcomm Sxr1230p Firmware
Qualcomm Sxr1230p
All of the following
Qualcomm Talynplus Firmware
Qualcomm Talynplus
All of the following
Qualcomm Wcd9370 Firmware
Qualcomm Wcd9370
All of the following
Qualcomm Wcd9375 Firmware
Qualcomm Wcd9375
All of the following
Qualcomm Wcd9380 Firmware
Qualcomm Wcd9380
All of the following
Qualcomm Wcd9385 Firmware
Qualcomm Wcd9385
All of the following
Qualcomm Wcd9390 Firmware
Qualcomm Wcd9390
All of the following
Qualcomm Wcd9395 Firmware
Qualcomm Wcd9395
All of the following
Qualcomm Wcn3950 Firmware
Qualcomm Wcn3950
All of the following
Qualcomm Wcn3988 Firmware
Qualcomm Wcn3988
All of the following
Qualcomm Wcn6740 Firmware
Qualcomm Wcn6740
All of the following
Qualcomm Wcn6755 Firmware
Qualcomm Wcn6755
All of the following
Qualcomm Wsa8810 Firmware
Qualcomm Wsa8810
All of the following
Qualcomm Wsa8815 Firmware
Qualcomm Wsa8815
All of the following
Qualcomm Wsa8830 Firmware
Qualcomm Wsa8830
All of the following
Qualcomm Wsa8832 Firmware
Qualcomm Wsa8832
All of the following
Qualcomm Wsa8835 Firmware
Qualcomm Wsa8835
All of the following
Qualcomm Wsa8840 Firmware
Qualcomm Wsa8840
All of the following
Qualcomm Wsa8845 Firmware
Qualcomm Wsa8845
All of the following
Qualcomm Wsa8845h Firmware
Qualcomm Wsa8845h
Google Android
android/platform/vendor/opensource/eva-kernel>=SoCVersion:0<SoCVersion:2024-09-05
SoCVersion:2024-09-05
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/vendor/opensource/eva-kernelto a version that resolves this vulnerability.Fixed in SoCVersion:2024-09-05
Event History
Sep 1, 2024
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Sep 2, 2024
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 3, 2024
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-33038?
CVE-2024-33038 is categorized as a high severity vulnerability due to potential memory corruption issues.
2
How do I fix CVE-2024-33038?
To mitigate CVE-2024-33038, update your affected Qualcomm firmware to the latest version provided by the vendor.
3
What causes CVE-2024-33038?
CVE-2024-33038 occurs due to memory corruption when untrusted or corrupted pointers are passed from the DSP to the EVA.
4
Which devices are affected by CVE-2024-33038?
CVE-2024-33038 affects various Qualcomm firmware including devices running Android with certain versions.
5
Is CVE-2024-33038 exploited in the wild?
As of now, there have been no public reports indicating that CVE-2024-33038 is being actively exploited in the wild.