CVE-2024-23377: qualcomm, inc. snapdragon Use of Out-of-range Pointer Offset

Vulnerability summary

CVE-2024-23377 is a medium (CVSS 6.7) Use of Out-of-range Pointer Offset vulnerability in qualcomm, inc. snapdragon. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.9% of scored vulnerabilities.

Timeline

1. 04-11-2024
   PublishedVulnerability first disclosed.
2. 08-11-2024
   Last modifiedVulnerability information updated.

Description

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.

• CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.