CVE-2023-33106
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
Description
CVE-2023-33106 is a high-severity memory corruption vulnerability in Qualcomm chipset firmware, receiving a CVSS 3.1 score of 8.4. The vulnerability is triggered when a large list of sync points is submitted through an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND interface, a kernel-level graphics subsystem interface. Insufficient bounds checking on the input data (CWE-119) and improper use of untrusted pointer values (CWE-823) result in memory corruption within the GPU kernel driver. A local attacker without any privileges can exploit this flaw to achieve full system compromise, including confidentiality, integrity, and availability impacts. Qualcomm has addressed this in its December 2023 Security Bulletin, and CISA has included it in the Known Exploited Vulnerabilities catalog with a December 26, 2023 remediation deadline.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | ar8035 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | fastconnect 6200 firmware | - |
| qualcomm | fastconnect 6700 firmware | - |
| qualcomm | fastconnect 6800 firmware | - |
| qualcomm | fastconnect 6900 firmware | - |
| qualcomm | fastconnect 7800 firmware | - |
| qualcomm | flight rb5 5g platform firmware | - |
| qualcomm | qam8255p firmware | - |
| qualcomm | qam8295p firmware | - |
| qualcomm | qam8650p firmware | - |
| qualcomm | qam8775p firmware | - |
| qualcomm | qca6174a firmware | - |
| qualcomm | qca6391 firmware | - |
| qualcomm | qca6426 firmware | - |
| qualcomm | qca6436 firmware | - |
| qualcomm | qca6574 firmware | - |
| qualcomm | qca6574a firmware | - |
| qualcomm | qca6574au firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33106(US Government Resource)
Weakness Type
CWE-823: Use of Out-of-Range Pointer Offset
CWE-823 describes a weakness where software calculates or uses a pointer that is outside the bounds of the intended memory buffer, leading to reads or writes in unintended memory regions. In the context of this vulnerability, the GPU kernel driver uses a pointer offset derived from the attacker-controlled sync point list without properly validating it, allowing out-of-bounds memory access.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 is the broader category covering buffer overflow and out-of-bounds memory access weaknesses. When the KGSL GPU AUX command handler processes a large list of sync points, it fails to properly restrict the number of elements or validate array boundaries, resulting in memory corruption that can overwrite kernel data structures adjacent to the allocated buffer.
Impact Analysis
CVE-2023-33106 is rated High with a CVSS score of 8.4. The attack requires local access (AV:L) but no privileges (PR:N) and no user interaction (UI:N), making it straightforward to exploit for anyone with local code execution on an affected device.
Confidentiality Impact (High): Memory corruption in the kernel GPU driver can expose sensitive kernel data, user credentials, cryptographic keys, or private application data to the attacker.
Integrity Impact (High): By corrupting kernel memory, the attacker can overwrite critical data structures, achieve arbitrary code execution in kernel context, and persistently compromise the device.
Availability Impact (High): The corruption may cause kernel panics, GPU driver crashes, or full device freezes, rendering the device non-functional.
Affected chipsets span a wide range of Qualcomm products used in smartphones, automotive systems, and connected devices. CISA’s KEV classification confirms that this vulnerability has been actively exploited in real-world attacks.
Exploit Maturity
CVE-2023-33106 has been confirmed as actively exploited and is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 26, 2023. The EPSS score of approximately 0.0016 (36.9th percentile) suggests exploitation is more targeted than widespread, consistent with sophisticated mobile exploitation campaigns. The local attack vector limits opportunistic mass exploitation, but targeted use by advanced threat actors — such as commercial spyware vendors — is well established for this class of Qualcomm vulnerability.
Remediation
- Apply Qualcomm’s December 2023 Security Bulletin patches: Obtain and install updated firmware from your device manufacturer that incorporates Qualcomm’s fix for CVE-2023-33106. Refer to the Qualcomm December 2023 Security Bulletin.
- Comply with CISA KEV deadline: Ensure patches are applied no later than December 26, 2023, as required by CISA’s known exploited vulnerability directive. Discontinue use if patching is not possible.
- Update all affected device firmware: Coordinate with OEM/device vendors to receive security updates that package Qualcomm’s patch.
- Restrict untrusted application execution: Prevent untrusted or sideloaded applications from running on affected devices, as local code execution is required to trigger the vulnerability.
- Implement endpoint detection: Deploy mobile threat detection solutions that can identify kernel exploitation attempts or anomalous GPU driver behavior.
- Audit device inventory: Identify all organizational devices using affected Qualcomm chipsets and prioritize them for immediate patching based on risk exposure.
Technical Details
CVE-2023-33106 involves two complementary weakness categories: CWE-823 (Use of Out-of-Range Pointer Offset) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
The vulnerability exists in the Qualcomm kernel GPU service layer (KGSL), specifically in the handler for the IOCTL_KGSL_GPU_AUX_COMMAND interface. This IOCTL allows user-space GPU applications to submit auxiliary commands, including synchronization points used to coordinate memory access between CPU and GPU.
When a user-space process submits an AUX command containing a large list of sync points, the kernel driver processes each sync point in sequence. Due to insufficient input validation, the driver does not enforce a maximum limit on the number of sync points, and does not verify that computed pointer offsets remain within the bounds of the allocated memory buffer. An attacker can craft an oversized sync point list that causes the driver to access memory beyond the allocated region, corrupting adjacent kernel memory.
The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that once local access is available, exploitation is low-complexity and yields full system compromise. The unchanged scope indicates the impact is constrained to the kernel security boundary, but total kernel compromise represents the highest possible system-level impact.
Frequently Asked Questions
What is IOCTL_KGSL_GPU_AUX_COMMAND and why is it relevant to this vulnerability?
IOCTL_KGSL_GPU_AUX_COMMAND is a kernel interface (IOCTL) provided by Qualcomm’s Kernel GPU Service Layer (KGSL) that allows user-space GPU applications to submit auxiliary commands, such as synchronization operations. The vulnerability lies in the lack of proper input validation when processing these commands, specifically when the submitted sync point list is abnormally large.
Which Qualcomm chipsets are affected by CVE-2023-33106?
A broad range of Qualcomm chipsets are affected, including the Fastconnect 6200/6700/6800/6900/7800 series, QAM series, QCA series, and Flight RB5 5G Platform, among many others. The full list is available in the Qualcomm December 2023 Security Bulletin.
Is CVE-2023-33106 related to CVE-2023-33107?
Both CVE-2023-33106 and CVE-2023-33107 are Qualcomm memory corruption vulnerabilities patched in the same December 2023 Security Bulletin. While they share a similar nature (memory corruption via IOCTL), they are distinct vulnerabilities affecting different code paths within the Qualcomm GPU driver stack.
How can I tell if my organization’s devices are at risk?
Check whether your devices use affected Qualcomm chipsets by consulting the Qualcomm December 2023 Security Bulletin. Contact your device OEM or MDM vendor to determine if security updates addressing this vulnerability have been released and applied to your device fleet.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.