CVE-2024-33045: qualcomm, inc. snapdragon Return of Stack Variable Address

Vulnerability summary

CVE-2024-33045 is a high (CVSS 8.4) Return of Stack Variable Address vulnerability in qualcomm, inc. snapdragon. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.8% of scored vulnerabilities.

Timeline

1. 02-09-2024
   PublishedVulnerability first disclosed.
2. 05-09-2024
   Last modifiedVulnerability information updated.

Description

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

• CWE-562Return of Stack Variable AddressA function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.