CVE-2023-33063
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Description
CVE-2023-33063 is a high-severity use-after-free vulnerability in Qualcomm’s DSP Services subsystem, with a CVSS 3.1 score of 7.8. The vulnerability occurs during a remote procedure call from the High-Level Operating System (HLOS) to the Digital Signal Processor (DSP), where an object or memory region is accessed after it has already been freed (CWE-416). A local attacker with low-level privileges can exploit this flaw to achieve arbitrary code execution in the DSP context, potentially compromising the confidentiality, integrity, and availability of the entire system. The vulnerability affects a wide variety of Qualcomm chipsets used across mobile, IoT, automotive, and networking platforms, and CISA has included it in the Known Exploited Vulnerabilities catalog with a December 26, 2023 remediation deadline.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | 315 5g iot modem firmware | - |
| qualcomm | apq8017 firmware | - |
| qualcomm | aqt1000 firmware | - |
| qualcomm | ar8031 firmware | - |
| qualcomm | ar8035 firmware | - |
| qualcomm | ar9380 firmware | - |
| qualcomm | c-v2x 9150 firmware | - |
| qualcomm | csr8811 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | csrb31024 firmware | - |
| qualcomm | wcn3991 firmware | - |
| qualcomm | wcn3998 firmware | - |
| qualcomm | wcn6750 firmware | - |
| qualcomm | qca6390 firmware | - |
| qualcomm | wcn685x-5 firmware | - |
| qualcomm | wcn685x-1 firmware | - |
| qualcomm | wcn785x-1 firmware | - |
| qualcomm | wcn785x-5 firmware | - |
| qualcomm | flight rb5 5g platform firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33063(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a class of memory safety vulnerability where software continues to use a pointer to a memory region after that region has been deallocated (freed). After memory is freed, the allocator may reuse it for a different allocation, or its contents may be undefined. If the original pointer is then dereferenced or the memory region is accessed again, the behavior is undefined and can lead to data corruption, application crashes, or arbitrary code execution.
In this CVE, the use-after-free occurs within Qualcomm’s DSP Services during a remote call path from HLOS to the DSP. A timing condition or improper reference counting during the HLOS-to-DSP call sequence causes memory associated with a DSP object or buffer to be freed prematurely, while a reference to that memory remains in use by the DSP service handler. An attacker who can trigger this sequence — even with a low-privilege local account — can cause the DSP to operate on attacker-controlled memory, enabling exploitation.
Impact Analysis
CVE-2023-33063 is rated High with a CVSS score of 7.8. The attack vector is local (AV:L), requires low privileges (PR:L), and requires no user interaction (UI:N). The scope is unchanged, meaning exploitation is contained within the DSP/kernel security boundary, but impacts all three security dimensions:
Confidentiality Impact (High): A successful use-after-free exploit in DSP Services can expose sensitive data processed by the DSP, including audio data, sensor readings, and potentially cryptographic material.
Integrity Impact (High): By controlling the memory freed and later reused by DSP Services, an attacker can manipulate DSP operations, corrupt data, or achieve arbitrary code execution within the DSP subsystem.
Availability Impact (High): Triggering the use-after-free can cause DSP crashes or kernel panics, leading to device instability or complete denial of service.
Given the ubiquity of Qualcomm chipsets across the mobile and IoT ecosystem, the breadth of affected devices is substantial.
Exploit Maturity
CVE-2023-33063 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS score of approximately 0.0044 (62.8th percentile) indicates a moderate probability of broader exploitation compared to many CVEs of similar severity. The requirement for local access limits mass exploitation, but the vulnerability class (use-after-free in DSP Services) is well-known to be exploited by commercial surveillance software and state-sponsored threat actors targeting high-value mobile devices. The KEV due date of December 26, 2023 underscores the urgency of patching.
Remediation
- Apply Qualcomm’s December 2023 Security Bulletin: Install firmware updates from your device manufacturer that incorporate Qualcomm’s patch for CVE-2023-33063. Reference: Qualcomm December 2023 Security Bulletin.
- Comply with the CISA KEV deadline: Ensure patches are deployed by December 26, 2023. Discontinue use of unpatched devices if patching is not feasible within the deadline.
- Prioritize high-value device patching: Devices used by executives, security personnel, or individuals handling sensitive data should be patched first, given the targeted exploitation patterns associated with this vulnerability class.
- Restrict local application privileges: Reduce the risk of exploitation by enforcing least-privilege access controls and preventing installation of untrusted applications.
- Enable device management controls: Use MDM (Mobile Device Management) solutions to monitor device patch status and enforce compliance across the device fleet.
- Monitor for DSP-related anomalies: Look for unusual crash reports, kernel panics, or unexpected DSP behavior that may indicate exploitation attempts.
Technical Details
CVE-2023-33063 is a Use After Free (CWE-416) vulnerability in Qualcomm’s DSP (Digital Signal Processor) Services subsystem. The DSP in Qualcomm SoCs handles computationally intensive tasks such as audio processing, AI inference, and sensor fusion, and communicates with the main processor (HLOS — High-Level Operating System) through a remote procedure call (RPC) mechanism.
During an HLOS-to-DSP remote call, the DSP Services layer manages shared memory regions and object references to facilitate data transfer between the two processors. The vulnerability arises from improper lifecycle management of a DSP object or memory buffer: the memory is freed on one side of the communication boundary (HLOS or DSP) while the other side still holds an active reference to it.
An attacker with a low-privilege local account can trigger this use-after-free condition by manipulating the timing or parameters of an RPC call. Once the freed memory is reused — as is typical in use-after-free scenarios — the attacker can potentially control the contents of the reallocated region, causing the DSP service handler to operate on attacker-controlled data. This can result in arbitrary code execution within the DSP security domain or kernel context.
The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects that while local access with low privileges is required, exploitation is low-complexity and achieves full system compromise across all three CIA dimensions.
Frequently Asked Questions
What is the HLOS-to-DSP communication path in Qualcomm devices?
In Qualcomm SoCs, the High-Level Operating System (HLOS — typically Android/Linux) communicates with the Digital Signal Processor (DSP) via a remote procedure call (RPC) mechanism managed by a kernel-level DSP Services layer. This communication facilitates offloading of audio, sensor, AI, and other processing tasks to the specialized DSP hardware.
How does a use-after-free vulnerability lead to code execution?
After memory is freed, the allocator may reuse that memory for a different purpose. In a use-after-free exploit, an attacker arranges for the freed memory to be reallocated with attacker-controlled content, then triggers the vulnerable code path that still holds a stale reference. The vulnerable code then operates on the attacker-supplied data, potentially leading to control flow hijacking and arbitrary code execution.
Does CVE-2023-33063 require physical access to exploit?
No. While the attack vector is local, a low-privilege malicious application installed on the device is sufficient to trigger the vulnerability. Physical access is not required, but remote exploitation would require a separate vulnerability to establish initial code execution on the device first.
Are all Qualcomm-based Android phones affected by this vulnerability?
Not all Qualcomm-based devices are affected. Only those using the specific chipsets listed in Qualcomm’s December 2023 Security Bulletin are vulnerable. Device users and administrators should check with their OEM (Samsung, Google, Xiaomi, etc.) to confirm whether a security update addressing CVE-2023-33063 has been released for their specific device model.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.